CLEANSTART-2026-ZN32454 When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers

🗓️ 27 Feb 2026 00:50:08Reported by GoogleType

osv

osv🔗 osv.dev👁 8 Views

Nginx blocks sharing IP and port allow session resumption to bypass client certificate authentication.

Reporter	Title	Published	Views	Family All 4155
zdt	nginx 1.20.0 DNS Resolver Off-By-One Heap Write Exploit	27 May 202100:00	–	zdt
zdt	Nginx 1.20.0 - Denial of Service Exploit	11 Jul 202200:00	–	zdt
Rockylinux	nodejs:18 security update	4 Dec 202509:03	–	rocky
Rockylinux	varnish security update	24 Oct 202318:36	–	rocky
Rockylinux	tomcat security update	24 Oct 202318:35	–	rocky
Rockylinux	varnish security update	24 Oct 202318:35	–	rocky
Rockylinux	toolbox security update	11 Nov 202323:00	–	rocky
Rockylinux	nginx:1.22 security update	11 Nov 202323:00	–	rocky
Rockylinux	nghttp2 security update	11 Nov 202323:00	–	rocky
Rockylinux	Satellite 6.14 security and bug fix update	11 Nov 202322:58	–	rocky

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-ZN32454.json
osv	www.osv.dev/vulnerability/CVE-2017-7529
osv	www.osv.dev/vulnerability/CVE-2018-16845
osv	www.osv.dev/vulnerability/CVE-2019-20372
osv	www.osv.dev/vulnerability/CVE-2019-9511
osv	www.osv.dev/vulnerability/CVE-2019-9513
osv	www.osv.dev/vulnerability/CVE-2019-9516
osv	www.osv.dev/vulnerability/CVE-2021-23017
osv	www.osv.dev/vulnerability/CVE-2021-46461
osv	www.osv.dev/vulnerability/CVE-2021-46462

09 Mar 2026 10:15Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.8

EPSS0.99999

nginx vulnerabilities shared address port session resumption client certificate bypass security flaw