The vulnerability lies in the ngx_stream_ssl_module of NGINX, where an improper handling of revoked certificates leads to the server accepting a TLS handshake even when an OCSP check reports the certificate as revoked. This flaw enables connections that bypass standard revocation validation, potentially allowing attackers to establish secure communications with compromised or stolen certificates, undermining the trust model of TLS and facilitating unauthorized data exchange. The weakness corresponds to CWE‑295 and CWE‑863.

Both F5's NGINX Open Source and NGINX Plus products are affected. No specific version numbers are listed, so this applies to all builds that include the ngx_stream_ssl_module configured with ssl_verify_client and ssl_ocsp directives.

The CVSS score is 5.3, indicating moderate risk. The EPSS score is below 1 %, suggesting that exploitation is currently uncommon. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation. An attacker would need to target a client or server configured to enforce client certificate verification and OCSP checking, then supply a revoked certificate to establish a TLS session that the server mistakenly accepts. Given the remote nature of the weakness, mitigation should be prioritized to protect any services that use mutual TLS or server-side certificate verification.