CLEANSTART-2026-ZT77083 When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers

🗓️ 18 Feb 2026 00:40:43Reported by GoogleType

osv

osv🔗 osv.dev👁 15 Views

Shared address and port server blocks enables session resumption to bypass authentication in nginx.

Reporter	Title	Published	Views	Family All 4155
zdt	nginx 1.20.0 DNS Resolver Off-By-One Heap Write Exploit	27 May 202100:00	–	zdt
zdt	Nginx 1.20.0 - Denial of Service Exploit	11 Jul 202200:00	–	zdt
Rockylinux	nodejs:18 security update	4 Dec 202509:03	–	rocky
Rockylinux	varnish security update	24 Oct 202318:36	–	rocky
Rockylinux	tomcat security update	24 Oct 202318:35	–	rocky
Rockylinux	varnish security update	24 Oct 202318:35	–	rocky
Rockylinux	toolbox security update	11 Nov 202323:00	–	rocky
Rockylinux	nginx:1.22 security update	11 Nov 202323:00	–	rocky
Rockylinux	nghttp2 security update	11 Nov 202323:00	–	rocky
Rockylinux	Satellite 6.14 security and bug fix update	11 Nov 202322:58	–	rocky

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-ZT77083.json
osv	www.osv.dev/vulnerability/CVE-2017-7529
osv	www.osv.dev/vulnerability/CVE-2018-16845
osv	www.osv.dev/vulnerability/CVE-2019-20372
osv	www.osv.dev/vulnerability/CVE-2019-9511
osv	www.osv.dev/vulnerability/CVE-2019-9513
osv	www.osv.dev/vulnerability/CVE-2019-9516
osv	www.osv.dev/vulnerability/CVE-2021-23017
osv	www.osv.dev/vulnerability/CVE-2021-46461
osv	www.osv.dev/vulnerability/CVE-2021-46462

19 Feb 2026 07:30Current

8.6High risk

Vulners AI Score8.6

CVSS 3.19.8

EPSS0.99999

server blocks shared address port session resumption bypass authentication nginx vulnerabilities