FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

freenginx -- TLS session ticket key left uninitialized

Affected packages
		freenginx	<	1.30.2

Details

VuXML ID	4784aba5-d6a9-11f1-8a93-a0369f6e85b8
Discovery	2026-10-27
Entry	2026-11-02

The freenginx project reports:

One of the keys was left uninitialized when using automatic rotation of TLS session ticket keys, making it possible to forge a session and bypass client certificate verification (CVE-2026-97629).

[source]

References

CVE Name	CVE-2026-97629
URL	https://freenginx.org/en/CHANGES
URL	https://freenginx.org/en/CHANGES-1.30