CVE-2026-28755

Name of the Vulnerable Software and Affected Versions NGINX Plus (affected versions not specified) NGINX Open Source (affected versions not specified)

Description The ngx stream ssl module module contains an issue with the improper handling of revoked certificates. When configured with the ssl verify client on and ssl ocsp on directives, the TLS handshake may succeed even if an Online Certificate Status Protocol (OCSP) check identifies the certificate as revoked. This flaw in the authorization procedure could allow a remote attacker to bypass security restrictions and gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.