AZL-86850
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-86850.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-86850
- Upstream
- Published
- 2026-05-13T16:16:43Z
- Modified
- 2026-09-01T05:28:09Z
- Summary
- CVE-2026-40701 affecting package nginx for versions less than 1.28.3-4
- Details
-
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpsslmodule module when the sslverifyclient directive is set to "on" or "optional," and the sslocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- References