UpHeron
All vulnerabilities

Servers and applications

CVE-2026-28755

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.   Note: Software versions which have reached End of Technical Support (EoTS)…

Severity
Medium 5.3
Published
24 Mar 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.28.3, 1.29.7
Sources
NVD

Affected software

SoftwareAffected versions
nginxServers and applications · cpe:a:f5:nginx_open_source
  • From 0.5.13 up to 0.9.7
  • From 1.27.2 before 1.28.3
  • From 1.29.0 before 1.29.7

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-28755
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-28755