CVE-2026-28755

NGINX ngx_stream_ssl_module vulnerability

State: Published
Severity: 5.3 Medium
Published: Mar 24, 2026
Updated: Mar 24, 2026
Reserved: Mar 18, 2026

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	f5
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	f5

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
NGINX Open SourceF5	1.29.0 to before 1.29.7Affected 1.27.2 to before 1.28.3Affected
NGINX PlusF5	R36 to before R36 P3Affected R35 to before R35 P2Affected R34 and laterAffected R33 and laterAffected

References

https://my.f5.com/manage/s/article/K000160368vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.