CVE-2026-40701

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40701
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40701.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40701
Aliases
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CGA (8)
CLSA (2)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (5)
OESA (5)
openSUSE (2)
SUSE (3)
UBUNTU (1)
Related
openSUSE (2)
SUSE (3)
Published
2026-05-13T16:16:43Z
Modified
2026-10-28T02:31:05Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:f5:dos:*:*:*:*:*:nginx:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "4.3.0"
                        },
                        {
                            "last_affected": "4.7.0"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "f5:dos"
        },
        {
            "cpes": [
                "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "3.5.0"
                        },
                        {
                            "last_affected": "3.7.2"
                        },
                        {
                            "introduced": "4.0.0"
                        },
                        {
                            "last_affected": "4.0.1"
                        },
                        {
                            "introduced": "5.0.0"
                        },
                        {
                            "last_affected": "5.4.2"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "f5:nginx_ingress_controller"
        },
        {
            "cpes": [
                "cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "2.16.0"
                        },
                        {
                            "last_affected": "2.22.0"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "f5:nginx_instance_manager"
        },
        {
            "cpes": [
                "cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "r32"
                        },
                        {
                            "last_affected": "r36"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "f5:nginx_plus"
        },
        {
            "cpes": [
                "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "4.9.0"
                        },
                        {
                            "last_affected": "4.16.0"
                        },
                        {
                            "introduced": "5.1.0"
                        },
                        {
                            "last_affected": "5.8.0"
                        },
                        {
                            "introduced": "5.9.0"
                        },
                        {
                            "last_affected": "5.12.1"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "f5:waf"
        },
        {
            "cpes": [
                "cpe:2.3:a:f5:dos:4.8.0:*:*:*:*:nginx:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "4.8.0"
                        },
                        {
                            "last_affected": "4.8.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "f5:dos"
        }
    ]
}
References

Affected packages

Git / github.com/nginx/nginx

Affected ranges

Type
GIT
Repo
https://github.com/nginx/nginx
Events
Introduced
87c8507f20eb32e757aa3ef2e709f395f577a7f6
Last Affected
6e14e954aaacce9a433d9b07b4653809c7594ab8
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.19.0"
                },
                {
                    "last_affected": "1.30.0"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

release-1.*
release-1.19.0
release-1.19.1
release-1.19.10
release-1.19.2
release-1.19.3
release-1.19.4
release-1.19.5
release-1.19.6
release-1.19.7
release-1.19.8
release-1.19.9
release-1.21.0
release-1.21.1
release-1.21.2
release-1.21.3
release-1.21.4
release-1.21.5
release-1.21.6
release-1.23.0
release-1.23.1
release-1.23.2
release-1.23.3
release-1.23.4
release-1.25.0
release-1.25.1
release-1.25.2
release-1.25.3
release-1.25.4
release-1.25.5
release-1.27.0
release-1.27.1
release-1.27.2
release-1.27.3
release-1.27.4
release-1.27.5
release-1.29.0
release-1.29.1
release-1.29.2
release-1.29.3
release-1.29.4
release-1.29.5
release-1.29.6
release-1.29.7
release-1.29.8
release-1.30.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40701.json"

Git / github.com/nginx/nginx-gateway-fabric

Affected ranges

Type
GIT
Repo
https://github.com/nginx/nginx-gateway-fabric
Events
Introduced
3a372747333fb1db372af7cf0b18ed7eef7c91f7
Last Affected
532db6a20b2912fe397211eef9f8d564d46a4bdd
Introduced
7dad8b31e3f0c3eadce36fed8c276e83e6583d24
Last Affected
95a66d8cec0ce98e1985aeab728317c5ba7ec0c6
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "1.3.0"
                },
                {
                    "last_affected": "1.6.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "last_affected": "2.6.0"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40701.json"