NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
References
| Link | Resource |
|---|---|
| https://my.f5.com/manage/s/article/K000161021 | Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
23 Jun 2026, 13:57
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
F5 nginx Open Source
F5 nginx Ingress Controller F5 nginx Instance Manager F5 dos F5 waf F5 nginx Gateway Fabric F5 nginx Plus F5 |
|
| CPE | cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:* cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:* cpe:2.3:a:f5:dos:4.8.0:*:*:*:*:nginx:*:* cpe:2.3:a:f5:dos:*:*:*:*:*:nginx:*:* cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* |
|
| References | () https://my.f5.com/manage/s/article/K000161021 - Mitigation, Vendor Advisory |
13 May 2026, 16:27
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-13 16:16
Updated : 2026-06-23 13:57
NVD link : CVE-2026-40701
Mitre link : CVE-2026-40701
CVE.ORG link : CVE-2026-40701
JSON object : View
Products Affected
f5
- dos
- nginx_open_source
- nginx_plus
- nginx_ingress_controller
- nginx_gateway_fabric
- nginx_instance_manager
- waf
CWE
CWE-416
Use After Free