CVE-2025-23419 TLS Session Resumption Vulnerability
Attackers can bypass client certificate authentication on NGINX servers sharing an IP/port by exploiting TLS session resumption mechanisms.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-23419?
CVE-2025-23419 is a medium-severity authentication bypass vulnerability in Debian Debian Linux, published on 5 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-863
Which versions are affected by CVE-2025-23419?
2 open source packages ship an affected version, including nginx and nginx-gateway. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
nginx Bitnami | From 1.11.4 | 1.26.3, 1.27.4 |
nginx-gateway Bitnami | From 1.11.4 | 1.26.3, 1.27.4 |
Linux distribution packages (27)
nginx Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-all-modules Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-core Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-core-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-filesystem Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-mod-http-image-filter Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-mod-http-image-filter-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-mod-http-perl Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-mod-http-perl-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-mod-http-xslt-filter Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-mod-http-xslt-filter-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-mod-mail Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-mod-mail-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-mod-stream Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-mod-stream-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 2:1.20.1-22.el9 |
nginx-core-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 2:1.20.1-22.el9 |
nginx-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 2:1.20.1-22.el9 |
nginx-debugsource Red Hat:enterprise_linux:9::crb | All versions | 2:1.20.1-22.el9 |
nginx-mod-devel Red Hat:enterprise_linux:9::crb | All versions | 2:1.20.1-22.el9 |
nginx-mod-http-image-filter-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 2:1.20.1-22.el9 |
nginx-mod-http-perl-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 2:1.20.1-22.el9 |
nginx-mod-http-xslt-filter-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 2:1.20.1-22.el9 |
nginx-mod-mail-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 2:1.20.1-22.el9 |
nginx-mod-stream-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 2:1.20.1-22.el9 |
nginx openSUSE:Tumbleweed | All versions | 1.27.4-1.1 |
Products include Debian Debian Linux, F5 Nginx, F5 Nginx Plus.
How do I fix CVE-2025-23419?
Upgrade nginx to a fixed version for your release line: 1.26.3 or 1.27.4.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-23419 being exploited?
There is no known exploitation of CVE-2025-23419 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2025-23419, AZL-56483, AZL-56492, BELL-CVE-2025-23419, BIT-nginx-2025-23419, BIT-nginx-gateway-2025-23419 and 11 more.