Use of uninitialized resource in F5 Networks products - CVE-2026-97629
Published: October 14, 2026
Vulnerability identifier: #VU155770
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-97629
CWE-ID: CWE-908
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass client certificate verification and access sensitive information.
The vulnerability exists due to use of an uninitialized resource in ngx_http_ssl_module when automatically rotating SSL session ticket keys. A remote attacker can forge client SSL sessions to bypass client certificate verification and access sensitive information.
Exploitation requires a shared SSL session cache configured without an explicit ssl_session_ticket_key file directive. Session forgery is non-deterministic and beyond the exploiter's control. Only the data plane is exposed; the control plane is not affected.
Affected software
NGINX Open Source
NGINX Instance Manager
NGINX Ingress Controller
NGINX Plus
NGINX Gateway Fabric
NGINX App Protect DoS
F5 DoS for NGINX
NGINX App Protect WAF
F5 WAF for NGINX
NGINX Instance Manager
NGINX Ingress Controller
NGINX Plus
NGINX Gateway Fabric
NGINX App Protect DoS
F5 DoS for NGINX
NGINX App Protect WAF
F5 WAF for NGINX
How to mitigate CVE-2026-97629
Install security update from vendor's website.
NGINX Open Source - addressed in versions 1.30.6, 1.31.7
NGINX Gateway Fabric - update to 2.8.0
NGINX Instance Manager - update to 2.24.0
F5 DoS for NGINX - update to 4.11.0
NGINX Ingress Controller - update to 5.7.0
F5 WAF for NGINX - addressed in versions 5.14.2, 5.16.0
NGINX Plus - update to 37.0.5
NGINX Gateway Fabric - update to 2.8.0
NGINX Instance Manager - update to 2.24.0
F5 DoS for NGINX - update to 4.11.0
NGINX Ingress Controller - update to 5.7.0
F5 WAF for NGINX - addressed in versions 5.14.2, 5.16.0
NGINX Plus - update to 37.0.5