CVE-2026-97629 F5 CVE debrief

Who should care

NGINX Plus and NGINX Open Source administrators, security teams responsible for web server configurations, and teams managing sensitive information accessed through these servers, should assess exposure and apply mitigations. This includes reviewing ssl_session_cache and ssl_session_ticket_key configurations, and monitoring for potential session forgery attempts.

Why it matters

CVE-2026-97629 is a medium-severity vulnerability in NGINX ngx_http_ssl_module that allows session forgery, potentially leading to bypassed client certificate verification and exposure of sensitive information. NGINX Plus and NGINX Open Source administrators should assess exposure and apply mitigations.

• Potential bypass of client certificate verification
• Exposure of resources or functionality to unintended actors
• Possible access to sensitive information
• Need for verification of ssl_session_cache and ssl_session_ticket_key configurations

Technical summary

The vulnerability allows a remote unauthenticated attacker to forge client SSL sessions in a non-deterministic manner, potentially bypassing verification of client certificates. This issue affects NGINX Plus versions before 37.1.0.1, 37.0.5.1, and R36, R35, R34, R33, as well as NGINX Open Source versions before 1.31.7, 1.30.6, and 1.23.3. NGINX Plus and NGINX Open Source administrators should assess exposure and apply mitigations. The vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information.

Defensive priority

Medium priority for NGINX Plus and NGINX Open Source administrators to assess exposure and apply mitigations.

Recommended defensive actions

• Assess NGINX Plus and NGINX Open Source deployments for exposure
• Verify ssl_session_cache and ssl_session_ticket_key configurations
• Apply vendor-provided mitigations or patches
• Monitor for potential session forgery attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the vulnerability. The vendor, F5, has provided an advisory on their website. A remote unauthenticated attacker could leverage this vulnerability to bypass verification of client certificates. This issue affects NGINX Plus versions before 37.1.0.1, 37.0.5.1, and R36, R35, R34, R33, as well as NGINX Open Source versions before 1.31.7, 1.30.6, and 1.23.3. The vulnerability allows a remote unauthenticated attacker to forge client SSL sessions in a non-determinisic

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.