CVE-2026-40701

NGINX ngx_http_ssl_module vulnerability

Published May 13, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Analysis

Technical impact

An unauthenticated attacker can exploit NGINX Plus or NGINX Open Source when the ssl_verify_client directive is set to "on" or "optional" and the ssl_ocsp directive is on or leaf parameters use a resolver. By sending specially crafted HTTPS requests, the attacker may trigger a heap‑use‑after‑free error in the NGINX worker process, which can result in limited modification of data or cause the worker process to restart, effectively creating a denial‑of‑service scenario.

Affected Systems

The vulnerability affects F5 NGINX Open Source and NGINX Plus installations that use the ngx_http_ssl_module with the conditions described above. No specific version numbers are provided, so all unpatched releases prior to the fix are potentially vulnerable.

Risk and Exploitability

The CVSS score of 6.3 indicates a moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The attack vector is inferred to be remote, via HTTPS requests, since the flaw is triggered by unauthenticated traffic to the SSL module.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

NGINX Plus

unknown

Version	Status	Constraints
`R37`	unaffected	< *
`R36`	affected	< R36 P4
`R32`	affected	< R32 P6

NGINX Open Source

unaffected

Version	Status	Constraints
`1.31.0`	unaffected	< *
`1.19.0`	affected	< 1.30.1

Configuration 1 [-]

OR	cpe:2.3:a:f5:dos::::::nginx::*
	cpe:2.3:a:f5:dos:4.8.0:::::nginx::
	cpe:2.3:a:f5:nginx_gateway_fabric::::::::
	cpe:2.3:a:f5:nginx_gateway_fabric::::::::
	cpe:2.3:a:f5:nginx_ingress_controller::::::::
	cpe:2.3:a:f5:nginx_ingress_controller::::::::
	cpe:2.3:a:f5:nginx_ingress_controller::::::::
	cpe:2.3:a:f5:nginx_instance_manager::::::::
	cpe:2.3:a:f5:nginx_open_source::::::::
	cpe:2.3:a:f5:nginx_plus::::::::
	cpe:2.3:a:f5:waf::::::nginx::*
	cpe:2.3:a:f5:waf::::::nginx::*
	cpe:2.3:a:f5:waf::::::nginx::*

No data.

Vendor Product Versions

Nginx Open Source

Version	Status	Scheme	Platform
`[1.19.0,1.30.1)`	affected	semver	—
`[1.31.0,*)`	unaffected	semver	—

Nginx Plus

Version	Status	Scheme	Platform
`[R36,R36 P4)`	affected	generic	—
`[R32,R32 P6)`	affected	generic	—
`[R37,*)`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade NGINX to the latest supported version that contains the fix.
If upgrading is not immediately possible, reconfigure ssl_verify_client to "off" and disable ssl_ocsp or remove resolver directives from leaf parameters to avoid the vulnerable path.
Limit exposure by allowing only trusted clients to reach the affected SSL endpoints while monitoring for anomalous request patterns.

Generated by OpenCVE AI on May 13, 2026 at 16:40 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4589-1	nginx security update
Debian DSA	DSA-6278-1	nginx security update
Ubuntu USN	USN-8375-1	nginx vulnerabilities
Ubuntu USN	USN-8354-1	nginx vulnerabilities

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.690% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://my.f5.com/manage/s/article/K000161021
https://nvd.nist.gov/vuln/detail/CVE-2026-40701
https://www.cve.org/CVERecord?id=CVE-2026-40701

History

May 22, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-40701 https://www.cve.org/CVERecord?id=CVE-2026-40701
Metrics	threat_severity `None`	threat_severity `Moderate`

May 13, 2026 6:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		F5 F5 nginx Open Source F5 nginx Plus
Vendors & Products		F5 F5 nginx Open Source F5 nginx Plus

May 13, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 13, 2026 3:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Title		NGINX ngx_http_ssl_module vulnerability
Weaknesses		CWE-416
References		https://my.f5.com/manage/s/article/K000161021
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N'}`