UpHeron
All vulnerabilities

Servers and applications

CVE-2025-23419

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache…

Severity
Medium 5.3
Published
5 Feb 2025
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.26.3, 1.27.4
Sources
NVD

Affected software

SoftwareAffected versions
nginxServers and applications · cpe:a:f5:nginx
  • From 1.11.4 before 1.26.3
  • From 1.27.0 before 1.27.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-23419
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-23419