CVE-2026-40701: F5 NGINX heap-use-after-free in ngx_http_ssl_module

CVE-2026-40701 · Severity: medium · CVSS 4.8 · Published 2026-05-13

NGINX Plus and NGINX Open Source, widely used web servers and load balancers, contain a vulnerability in their SSL module when specific client verification and certificate status features are enabled. An unauthenticated attacker can send specially crafted network requests that may cause the NGINX worker process to crash or allow for limited unauthorized data modification. This can lead to service instability and potential disruptions to web application availability.

Technologies: F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, F5 Nginx Plus, NGINX Open Source. Vendors: F5, NGINX.

Quick answers

Is CVE-2026-40701 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40701 being exploited in the wild.
How severe is CVE-2026-40701?
Medium severity, with a CVSS score of 4.8, published 13 May 2026.
Which products and versions are affected?
F5 Nginx Gateway Fabric 1.3.0-1.6.2, 2.0.0-2.6.0; F5 Nginx Ingress Controller 4.0.0-4.0.1, 3.5.0-3.7.2, 5.0.0-5.4.2; F5 Nginx Plus R32 up to R32 P6, R36 up to R36 P4.
Is there a fix for CVE-2026-40701?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40701 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-40701?
Check whether you run F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, F5 Nginx Plus or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-use-after-free vulnerability exists in the ngx_http_ssl_module of NGINX Plus and NGINX Open Source. The flaw is triggered when 'ssl_verify_client' is set to 'on' or 'optional' and 'ssl_ocsp' is enabled (or leaf parameters are configured with a resolver). An unauthenticated remote attacker can exploit this by sending requests under specific conditions beyond their direct control, leading to a worker process restart (DoS) or limited data modification. The vulnerability is tracked as CVE-2026-40701 and has been addressed in NGINX Open Source 1.30.1 and specific patches for NGINX Plus R32 and R36.

Affected products

  • F5 NGINX Plus R32 up to R32 P6, R36 up to R36 P4
  • F5 NGINX Open Source 1.19.0 up to 1.30.1
  • F5 NGINX Ingress Controller 4.0.0-4.0.1, 3.5.0-3.7.2, 5.0.0-5.4.2
  • F5 NGINX Gateway Fabric 1.3.0-1.6.2, 2.0.0-2.6.0

Timeline

  • 2026-05-13: advisory: Initial advisory published by F5 Networks
  • 2026-05-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.