Unrated severityNVD Advisory· Published Dec 8, 2014· Updated Jun 17, 2026

CVE-2014-3616

Description

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Nginx/Nginxllm-fuzzy
Range: >=0.5.6 <=1.7.4
osv-coords
pkg:rpm/opensuse/nginx&distro=openSUSE%20Tumbleweed
Range: < 1.11.4-2.5

Patches

Vulnerability mechanics

References

mailman.nginx.org/pipermail/nginx-announce/2014/000147.htmlnvdVendor Advisory
www.debian.org/security/2014/dsa-3029nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.005
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000