CVE-2014-3616

15

FAUCET Score

CVE-2014-3616 describes a "virtual host confusion" vulnerability affecting NGINX versions 0.5.6 through 1.7.4. This flaw arises when multiple NGINX servers share the same SSL session cache or ticket key, allowing a cached SSL session to be reused in an unintended context. Rated with a CVSS score of 4.3, this vulnerability has a network attack vector and medium attack complexity, potentially leading to unauthorized information modification (integrity impact) but no confidentiality or availability impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 0.5.6, < 1.6.2CPE matchmatch criteria	cpe:2.3:a:f5:nginx::::::::
		>= 1.7.0, < 1.7.5CPE matchmatch criteria	cpe:2.3:a:f5:nginx::::::::
		7.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:7.0:::::::*
		8.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:8.0:::::::*

CVSS Data

CVSS version used by this source: 2.0

4.3MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Exploitability Score

8.6

Impact Score

2.9

CvssVersion

2.0

Exploit Intelligence

EPSS Score

5.65%

Probability of exploitation in next 30 days

EPSS Percentile

92.2%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0565 is in the 91st percentile among its peer group of 19,958 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (10)

netgearpatch availablevia llm_extracted

Fixed in: 1.7.5+, 1.6.2+

opensshpatch availablevia llm_extracted

Fixed in: 1.7.5

power_bipatch availablevia llm_extracted

Fixed in: 1.6.2

terraformpatch availablevia llm_extracted

Fixed in: 1.7.5

dahuavendor investigatingvia llm_extracted

Fixed in: 1.6.2+

dfinityvendor investigatingvia llm_extracted

Fixed in: 1.7.5

jfrogvendor investigatingvia llm_extracted

Fixed in: 1.7.5

liferayvendor investigatingvia llm_extracted

Fixed in: 1.6.2

redhatno patchvia redhat_api

Product: Red Hat Software CollectionsFixed in: nginx16-nginx

redhatend of lifevia redhat_api

Product: Red Hat Software CollectionsFixed in: nginx14-nginx

Vendor Advisories (9)

redhatCVE-2014-3616Moderate

nginx: virtual host confusion

opensshllm-openssh-92dc4d37d816343fMEDIUM

SSL session reuse vulnerability

dfinityllm-dfinity-19b85ae5e367e183MEDIUM

SSL session reuse vulnerability

power_billm-power_bi-ff8a36358edd6610MEDIUM

SSL session reuse vulnerability

liferayllm-liferay-a8e22c36955f4c81MEDIUM

SSL session reuse vulnerability

jfrogllm-jfrog-c054afbc7c443cd0MEDIUM

SSL session reuse vulnerability

dahuallm-dahua-9e1534147d34520bMEDIUM

SSL session reuse vulnerability

terraformllm-terraform-23ad8ffeb7e82d6cMEDIUM

SSL session reuse vulnerability

netgearllm-netgear-7022a5f6e428735bMEDIUM

SSL session reuse vulnerability

References

mailman.nginx.org / pipermail/nginx-announce/2014/000147.html

Vendor Advisory

debian.org / security/2014/dsa-3029

Third Party Advisory