cve-2020-13777

Zeek test script for CVE-2020-13777 This script performs a simple test to check if a server is potentially vulnerable to CVE-2020-13777. CVE-2020-13777 causes GnuTLS to create unencrypted session tickets. This seems to be detectable by checking gnutls sets the keyname to zero - for which it uses...

NGINX 1.31.6 TLS Session Ticket Forgery

NGINX versions 1.23.2 through 1.31.6 contain a TLS session-ticket forgery vulnerability that may bypass client-certificate verification when shared session caching and automatic ticket-key rotation are used. The included proof of concept targets a loopback lab server...

USN-8955-1 nginx vulnerabilities

It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-15176 It was discovered tha...

CVE-2026-116540 netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssltlsextticketkeycb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed...

CVE-2026-116540 netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssltlsextticketkeycb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed...

CVE-2026-116540

The netty-tcnative library, specifically versions 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x , contains a Use-After-Free vulnerability (CWE-416) in the ssl_tlsext_ticket_key_cb function. This issue occurs during session ticket key rotation; if a remote client performs a TLS handsh...

nginx 1.31.6 TLS Session Ticket Forgery

nginx versions 1.23.2 through 1.31.6 contain a TLS session-ticket forgery issue that can allow session resumption without client-certificate authentication. The proof of concept forges a ticket using an uninitialized key slot. https://packetstorm.news/download/237045...

Exploit for CVE-2026-97629

CVE-2026-97629 — nginx TLS session-ticket forgery client-cert...

CVE-2026-111815 Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4,...

CVE-2026-111815

Apache Traffic Server is vulnerable to a flaw where it can resume a TLS session across different SNI virtual hosts without re-verifying a client certificate. This bypasses the verify_client STRICT policy required by the host being resumed to. Affected versions include 8.0.0 through 8.1.11 , 9.0.0...

CVE-2026-111815 Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4,...

BIT-NGINX-2026-97629 NGINX ngx_http_ssl_module vulnerability

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

CVE-2026-97629

A flaw was found in nginx. Under specific configurations where shared SSL session caching is enabled without explicit session ticket key rotation, a remote unauthenticated attacker may be able to forge client Secure Sockets Layer SSL sessions. This flaw allows an attacker to bypass client...

FreeBSD : nginx -- multiple vulnerabilities (95970257-c867-11f1-9006-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 95970257-c867-11f1-9006-3497f65b111b advisory. The nginx developers report: A buffer overflow might occur in a worker process when using the...

NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a...

EUVD-2026-101113

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

PT-2026-114364

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description When configured with ssl session cache shared:name:size without explicit ssl session ticket key file directives for automatic rotation of...

CVE-2026-97629: Use of Uninitialized Resource

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

nginx -- multiple vulnerabilities

The nginx developers report: A buffer overflow might occur in a worker process when using the "alias" directive if the request URI was changed by the "rewrite" directive and was then mapped to a file path CVE-2026-15176. A buffer overflow might occur in a worker process while evaluating string...

[slackware-security] stunnel

New stunnel packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/stunnel-5.82-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Fixed truncation and out-of-bounds reads when inheriti...