PT-2026-27433 · F5+4 · Nginx Plus+5

Mufeed Vh · Published 2026-03-24 · Updated 2026-05-20 · CVE-2026-28755

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions NGINX Plus (affected versions not specified) NGINX Open Source (affected versions not specified)

Description The ngx stream ssl module module contains an issue with the improper handling of revoked certificates. When configured with the ssl verify client on and ssl ocsp on directives, the TLS handshake may succeed even if an Online Certificate Status Protocol (OCSP) check identifies the certificate as revoked. This flaw in the authorization procedure could allow a remote attacker to bypass security restrictions and gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2026-04821

BIT-NGINX-2026-28755

BIT-NGINX-GATEWAY-2026-28755

CVE-2026-28755

OPENSUSE-SU-2026:10423-1

RHSA-2026:8346

USN-8210-1

Affected Products

Linuxmint

Nginx Open Source

Nginx Plus

Nginx

Red Os

Ubuntu

References · 38

• https://ubuntu.com/security/CVE-2026-27651 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27654 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28755 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2026-28755 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04821 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28755 · Vendor Advisory
• https://my.f5.com/manage/s/article/K000160368 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-28755 · Security Note
• https://ubuntu.com/security/CVE-2026-27784 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28755 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8210-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-28755 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8210-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28753 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-28755 · Vendor Advisory