CVE-2026-28755

A flaw was found in NGINX, specifically within its ngx_stream_ssl_module. When NGINX is configured to verify client certificates and use the Online Certificate Status Protocol (OCSP) for revocation checks, it fails to properly enforce the revocation status. This allows a Transport Layer Security (TLS) handshake to complete successfully, even if the client's certificate has been identified as revoked. Consequently, systems using revoked certificates may still be able to establish connections, potentially leading to unauthorized access or communication.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.