Vulnerability · Published Mar 24, 2026 · Assigned by f5

CVE-2026-28755NGINX ngx_stream_ssl_module vulnerability

Medium 5.4

In plain English

A medium-severity incorrect authorization in NGINX Open Source from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.1%top 96.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.22	nginx	1.28.3-r0	ALPINE-CVE-2026-28755
Alpine:v3.23	nginx	1.28.3-r0	ALPINE-CVE-2026-28755
Alpine:v3.24	nginx	1.28.3-r0	ALPINE-CVE-2026-28755
Debian:14	nginx	1.28.3-2	DEBIAN-CVE-2026-28755
Ubuntu:24.04:LTS	nginx	1.24.0-2ubuntu7.7	UBUNTU-CVE-2026-28755
Ubuntu:25.10	nginx	1.28.0-6ubuntu1.2	UBUNTU-CVE-2026-28755

Affected products (as reported)

Vendor	Product	Versions
F5	NGINX Open Source	1.29.0 – before 1.29.71.27.2 – before 1.28.3
F5	NGINX Plus	R36 – before R36 P3R35 – before R35 P2R34 – before R33 – before

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://my.f5.com/manage/s/article/K000160368 vendor-advisory