CVE-2026-97629 vulnerability in F5 Networks Products
Published on October 14, 2026
NGINX ngx_http_ssl_module vulnerability
Description
When NGINX Plus or NGINX Open Source is configured with ssl_session_cache
shared:name:size
without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions
in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.
Impact
This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability Analysis
CVE-2026-97629 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
Use of Uninitialized Resource
The software uses or accesses a resource that has not been initialized. When a resource has not been properly initialized, the software may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the software.
Products Associated with CVE-2026-97629
stack.watch emails you whenever new vulnerabilities are published in F5 Networks Nginx Plus or F5 Networks Nginx Open Source. Just hit a watch button to start following.
Affected Versions
F5 NGINX Plus:- Version 37.1.0 and below 37.1.0.1 is affected.
- Version 37.0.0 and below 37.0.5.1 is affected.
- Version R36 and below * is affected.
- Version R35 and below * is affected.
- Version R34 and below * is affected.
- Version R33 and below * is affected.
- Version 1.31.0 and below 1.31.7 is affected.
- Version 1.30.0 and below 1.30.6 is affected.
- Version 1.23.3 and below * is affected.