Resolving a Mutual TLS session resumption vulnerability
Feb 7, 2025Matt Bullock, Rushil Mehra, Alessandro Ghedini
Summary
This post details a vulnerability in Cloudflare's Mutual TLS (mTLS) implementation related to session resumption, tracked as CVE-2025-23419. A flaw in how BoringSSL handled session caches allowed a client with a valid mTLS certificate for one zone to resume a TLS session with another zone without re-authentication. Cloudflare mitigated this by disabling TLS session resumption for all customers with mTLS enabled and is exploring ways to reintroduce performance benefits. The post also provides guidance on further hardening mTLS configurations using Transform Rules, logging, and WAF custom rules, including passing client certificate metadata to origins.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack