CVE-2026-119568

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssldataaccept that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the...

EUVD-2026-113833

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssldataaccept that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the...

CVE-2026-119568

The vsftpd file transfer server, versions through 3.0.5 , is vulnerable to an authentication bypass in the ssl_data_accept() function. This flaw allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session tickets. Specifically, attackers who share the victim...

CVE-2026-119568 vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssldataaccept that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the...

cve-2020-13777

Zeek test script for CVE-2020-13777 This script performs a simple test to check if a server is potentially vulnerable to CVE-2020-13777. CVE-2020-13777 causes GnuTLS to create unencrypted session tickets. This seems to be detectable by checking gnutls sets the keyname to zero - for which it uses...

CVE-2026-103963

A vulnerability exists in glib-networking where the client-side session cache fails to limit the number of session tickets retained for a single host when using TLS version 1.3 . A malicious server can exploit this by sending excessive session ticket messages, leading to unbounded memory growth ....

CVE-2026-103963 Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service

A flaw was found in glib-networking. When establishing connections using Transport Layer Security TLS version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket message...

PT-2026-133506

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl data accept that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the...

NGINX 1.31.6 TLS Session Ticket Forgery

NGINX versions 1.23.2 through 1.31.6 contain a TLS session-ticket forgery vulnerability that may bypass client-certificate verification when shared session caching and automatic ticket-key rotation are used. The included proof of concept targets a loopback lab server...

USN-8955-1 nginx vulnerabilities

It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-15176 It was discovered tha...

CVE-2026-116540 netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssltlsextticketkeycb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed...

CVE-2026-116540 netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssltlsextticketkeycb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed...

CVE-2026-116540

The netty-tcnative library, specifically versions 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x , contains a Use-After-Free vulnerability (CWE-416) in the ssl_tlsext_ticket_key_cb function. This issue occurs during session ticket key rotation; if a remote client performs a TLS handsh...

nginx 1.31.6 TLS Session Ticket Forgery

nginx versions 1.23.2 through 1.31.6 contain a TLS session-ticket forgery issue that can allow session resumption without client-certificate authentication. The proof of concept forges a ticket using an uninitialized key slot. https://packetstorm.news/download/237045...

Exploit for CVE-2026-97629

CVE-2026-97629 — nginx TLS session-ticket forgery client-cert...

CVE-2026-111815 Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4,...

CVE-2026-111815 Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4,...

CVE-2026-111815

Apache Traffic Server is vulnerable to a flaw where it can resume a TLS session across different SNI virtual hosts without re-verifying a client certificate. This bypasses the verify_client STRICT policy required by the host being resumed to. Affected versions include 8.0.0 through 8.1.11 , 9.0.0...

BIT-NGINX-2026-97629 NGINX ngx_http_ssl_module vulnerability

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

CVE-2026-97629

A flaw was found in nginx. Under specific configurations where shared SSL session caching is enabled without explicit session ticket key rotation, a remote unauthenticated attacker may be able to forge client Secure Sockets Layer SSL sessions. This flaw allows an attacker to bypass client...