CVE-2025-23419

CVE-2025-23419 is a medium-severity vulnerability in F5 Nginx with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-863.

Key facts

• Severity: Medium (CVSS 3.x base score 4.3)
• CVSS v4: 5.3
• EPSS exploit prediction: 3% (84th percentile)
• Actively exploited: Not listed in CISA KEV
• EU (EUVD) id: EUVD-2025-3168
• Weakness: CWE-863
• Affected product: F5 Nginx
• Published: 2025-02-05
• Last modified: 2026-06-17

Description

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Frequently asked questions

What is CVE-2025-23419?

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

How severe is CVE-2025-23419?

CVE-2025-23419 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2025-23419 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (84th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-23419?

CVE-2025-23419 primarily affects F5 Nginx. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2025-23419?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-23419 have an EU (EUVD) identifier?

Yes. CVE-2025-23419 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-3168.

When was CVE-2025-23419 published?

CVE-2025-23419 was published on 2025-02-05 and last updated on 2026-06-17.

References

• https://my.f5.com/manage/s/article/K000149173
• http://www.openwall.com/lists/oss-security/2025/02/05/8
• https://lists.debian.org/debian-lts-announce/2025/03/msg00017.html

Affected products (7)

• cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*
• cpe:2.3:a:f5:nginx_plus:r32:-:*:*:*:*:*:*
• cpe:2.3:a:f5:nginx_plus:r32:p1:*:*:*:*:*:*
• cpe:2.3:a:f5:nginx_plus:r33:-:*:*:*:*:*:*
• cpe:2.3:a:f5:nginx_plus:r33:p1:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

More vulnerabilities in F5 Nginx

• CVE-2017-20005 — Critical (CVSS 9.8): NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a…
• CVE-2016-0746 — Critical (CVSS 9.8): Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote…
• CVE-2009-3555 — Critical (CVSS 9.8): The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services…
• CVE-2016-1247 — High (CVSS 7.8): The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04…
• CVE-2021-23017 — High (CVSS 7.7): A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from…
• CVE-2023-44487 — High (CVSS 7.5): The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset…

All CVEs affecting F5 Nginx →

Other CWE-863 (Incorrect Authorization) vulnerabilities

• CVE-2026-48286 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization…
• CVE-2026-48303 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization…
• CVE-2026-44330 — Critical (CVSS 10.0): free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the…
• CVE-2026-46595 — Critical (CVSS 10.0): Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of…
• CVE-2026-33105 — Critical (CVSS 10.0): Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over…
• CVE-2026-32213 — Critical (CVSS 10.0): Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

Browse all CWE-863 (Incorrect Authorization) vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE:

• 196.188.93.169 (ipv4-addr)
• 134.209.202.49 (ipv4-addr)
• 180.93.138.150 (ipv4-addr)
• 5.182.26.69 (ipv4-addr)
• 45.67.217.113 (ipv4-addr)
• 115.190.154.102 (ipv4-addr)
• 101.126.145.214 (ipv4-addr)
• 111.231.164.195 (ipv4-addr)