CLEANSTART-2026-AF45008 When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers

🗓️ 21 Apr 2026 00:40:00Reported by GoogleType

osv🔗 osv.dev👁 21 Views

Multiple server blocks sharing an IP and port allow session resumption to bypass client certificate authentication.

Reporter	Title	Published	Views	Family All 3997
zdt	nginx 1.20.0 DNS Resolver Off-By-One Heap Write Exploit	27 May 202100:00	–	zdt
zdt	Nginx 1.20.0 - Denial of Service Exploit	11 Jul 202200:00	–	zdt
Positive Technologies	PT-2021-3392 · Eclipse +2 · Eclipse Jetty +2	22 Jun 202100:00	–	ptsecurity
Positive Technologies	PT-2021-3584	12 May 202100:00	–	ptsecurity
Positive Technologies	PT-2021-3586	15 Jun 202100:00	–	ptsecurity
Positive Technologies	PT-2021-6553 · Eclipse +2 · Eclipse Jetty +2	15 Jul 202100:00	–	ptsecurity
Positive Technologies	PT-2021-7027	10 Mar 202100:00	–	ptsecurity
Positive Technologies	PT-2021-7931 · Unknown +5 · Bzip2Decoder +5	9 Sep 202100:00	–	ptsecurity
Positive Technologies	PT-2021-7933 · Eclipse +3 · Eclipse Jetty +3	9 Jun 202100:00	–	ptsecurity
Positive Technologies	PT-2021-7976 · Netty +5 · Netty +5	9 Sep 202100:00	–	ptsecurity

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AF45008.json
osv	www.osv.dev/vulnerability/CVE-2017-7529
osv	www.osv.dev/vulnerability/CVE-2018-16845
osv	www.osv.dev/vulnerability/CVE-2019-20372
osv	www.osv.dev/vulnerability/CVE-2019-9511
osv	www.osv.dev/vulnerability/CVE-2019-9513
osv	www.osv.dev/vulnerability/CVE-2019-9516
osv	www.osv.dev/vulnerability/CVE-2021-23017
osv	www.osv.dev/vulnerability/CVE-2021-46461
osv	www.osv.dev/vulnerability/CVE-2021-46462

23 Apr 2026 05:01Current

7.1High risk

Vulners AI Score7.1

CVSS 3.19.8

EPSS0.99999