The vulnerability of the TLS 1.3 implementation in NGINX Plus and NGINX Open Source web servers allows a perpetrator to gain unauthorized access to protected information.

🗓️ 27 Mar 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

TLS 1.3 flaws in NGINX Plus and Open Source allow remote attackers to access protected information.

Reporter	Title	Published	Views	Family All 114
IBM Security Bulletins	Security Bulletin: Vulnerability in nginx affects IBM Netezza Appliance	24 Dec 202509:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Performance Server Replication Services	27 Feb 202619:55	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in nginx affects IBM Robotic Process Automation for Cloud Pak	23 Mar 202613:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component was using python,nginx and packages which were vulnerable to CVE-2025-4435, CVE-2025-23419, CVE-2025-4330, CVE-2025-4138, CVE-2025-47273	6 Feb 202606:19	–	ibm
FreeBSD	nginx-devel -- SSL session reuse vulnerability	5 Feb 202500:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2025-842)	26 Feb 202500:00	–	nessus
Tenable Nessus	Amazon Linux 2 : nginx (ALASNGINX1-2025-008)	28 Mar 202500:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: nginx (CVE-2025-23419)	21 Feb 202500:00	–	nessus
Tenable Nessus	Debian dla-4091 : libnginx-mod-http-auth-pam - security update	25 Mar 202500:00	–	nessus
Tenable Nessus	Fedora 40 : nginx / nginx-mod-fancyindex / nginx-mod-modsecurity / etc (2025-016ed44ddc)	15 Feb 202500:00	–	nessus

Vulners

Node

red_hat red_hat_ansible_automation_platformMatch1.2

OR

nginx nginx_open_sourceRange1.11.4–1.27.4

OR

red_hat red_hat_enterprise_linuxMatch9

OR

canonical ubuntuMatch24.10

Source	Link
my	www.my.f5.com/manage/s/article/K000149173
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
access	www.access.redhat.com/security/cve/cve-2025-23419
security-tracker	www.security-tracker.debian.org/tracker/CVE-2025-23419
ubuntu	www.ubuntu.com/security/CVE-2025-23419
altsp	www.altsp.su/obnovleniya-bezopasnosti/
abf	www.abf.rosa.ru/advisories/ROSA-SA-2025-2895
angie	www.angie.software/angie/docs/oss_changes/
angie	www.angie.software/angie/docs/pro_changes/
angie	www.angie.software/adc/docs/adc-changes/

01 Jun 2026 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 24

CVSS 34.3

EPSS0.02557

authentication flaws remote access protected information nginx plus nginx open source