Home

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

PUBLISHED Reserved 2026-04-30 | Published 2026-05-13 | Updated 2026-05-13 | Assigner f5




MEDIUM: 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

MEDIUM: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Problem types

CWE-416 Use After Free

Product status

Default status
unknown

R37 (custom) before *
unaffected

R36 (custom) before R36 P4
affected

R32 (custom) before R32 P6
affected

Default status
unaffected

1.31.0 (semver) before *
unaffected

1.19.0 (semver) before 1.30.1
affected

Credits

F5 acknowledges Zhenpeng (Leo) Lin of depthfirst for bringing this issue to our attention and following the highest standards of coordinated disclosure. finder

References

my.f5.com/manage/s/article/K000161021 vendor-advisory patch

cve.org (CVE-2026-40701)

nvd.nist.gov (CVE-2026-40701)

Download JSON