CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-40701

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.007

EPSS Ranking 47.5%

CVSS Severity

CVSS v3 Score 4.8

References

https://my.f5.com/manage/s/article/K000161021

Products affected by CVE-2026-40701

F5 » Dos » Version: 4.3.0

cpe:2.3:a:f5:dos:4.3.0
F5 » Dos » Version: 4.4.0

cpe:2.3:a:f5:dos:4.4.0
F5 » Dos » Version: 4.5.0

cpe:2.3:a:f5:dos:4.5.0
F5 » Dos » Version: 4.6.0

cpe:2.3:a:f5:dos:4.6.0
F5 » Dos » Version: 4.7.0

cpe:2.3:a:f5:dos:4.7.0
F5 » Dos » Version: 4.8.0

cpe:2.3:a:f5:dos:4.8.0
F5 » Nginx Gateway Fabric » Version: 1.3.0

cpe:2.3:a:f5:nginx_gateway_fabric:1.3.0
F5 » Nginx Gateway Fabric » Version: 1.4.0

cpe:2.3:a:f5:nginx_gateway_fabric:1.4.0
F5 » Nginx Gateway Fabric » Version: 1.5.0

cpe:2.3:a:f5:nginx_gateway_fabric:1.5.0
F5 » Nginx Gateway Fabric » Version: 1.5.1

cpe:2.3:a:f5:nginx_gateway_fabric:1.5.1
F5 » Nginx Gateway Fabric » Version: 1.6.0

cpe:2.3:a:f5:nginx_gateway_fabric:1.6.0
F5 » Nginx Gateway Fabric » Version: 1.6.1

cpe:2.3:a:f5:nginx_gateway_fabric:1.6.1
F5 » Nginx Gateway Fabric » Version: 1.6.2

cpe:2.3:a:f5:nginx_gateway_fabric:1.6.2
F5 » Nginx Gateway Fabric » Version: 2.0.0

cpe:2.3:a:f5:nginx_gateway_fabric:2.0.0
F5 » Nginx Gateway Fabric » Version: 2.0.1

cpe:2.3:a:f5:nginx_gateway_fabric:2.0.1
F5 » Nginx Gateway Fabric » Version: 2.0.2

cpe:2.3:a:f5:nginx_gateway_fabric:2.0.2
F5 » Nginx Gateway Fabric » Version: 2.1.0

cpe:2.3:a:f5:nginx_gateway_fabric:2.1.0
F5 » Nginx Gateway Fabric » Version: 2.1.1

cpe:2.3:a:f5:nginx_gateway_fabric:2.1.1
F5 » Nginx Gateway Fabric » Version: 2.1.2

cpe:2.3:a:f5:nginx_gateway_fabric:2.1.2
F5 » Nginx Gateway Fabric » Version: 2.1.3

cpe:2.3:a:f5:nginx_gateway_fabric:2.1.3
F5 » Nginx Gateway Fabric » Version: 2.1.4

cpe:2.3:a:f5:nginx_gateway_fabric:2.1.4
F5 » Nginx Gateway Fabric » Version: 2.2.0

cpe:2.3:a:f5:nginx_gateway_fabric:2.2.0
F5 » Nginx Gateway Fabric » Version: 2.2.1

cpe:2.3:a:f5:nginx_gateway_fabric:2.2.1
F5 » Nginx Gateway Fabric » Version: 2.2.2

cpe:2.3:a:f5:nginx_gateway_fabric:2.2.2
F5 » Nginx Gateway Fabric » Version: 2.3.0

cpe:2.3:a:f5:nginx_gateway_fabric:2.3.0
F5 » Nginx Gateway Fabric » Version: 2.4.0

cpe:2.3:a:f5:nginx_gateway_fabric:2.4.0
F5 » Nginx Gateway Fabric » Version: 2.4.1

cpe:2.3:a:f5:nginx_gateway_fabric:2.4.1
F5 » Nginx Gateway Fabric » Version: 2.4.2

cpe:2.3:a:f5:nginx_gateway_fabric:2.4.2
F5 » Nginx Gateway Fabric » Version: 2.5.0

cpe:2.3:a:f5:nginx_gateway_fabric:2.5.0
F5 » Nginx Gateway Fabric » Version: 2.5.1

cpe:2.3:a:f5:nginx_gateway_fabric:2.5.1
F5 » Nginx Gateway Fabric » Version: 2.6.0

cpe:2.3:a:f5:nginx_gateway_fabric:2.6.0
F5 » Nginx Ingress Controller » Version: 3.5.0

cpe:2.3:a:f5:nginx_ingress_controller:3.5.0
F5 » Nginx Ingress Controller » Version: 3.5.1

cpe:2.3:a:f5:nginx_ingress_controller:3.5.1
F5 » Nginx Ingress Controller » Version: 3.5.2

cpe:2.3:a:f5:nginx_ingress_controller:3.5.2
F5 » Nginx Ingress Controller » Version: 3.6.0

cpe:2.3:a:f5:nginx_ingress_controller:3.6.0
F5 » Nginx Ingress Controller » Version: 3.6.1

cpe:2.3:a:f5:nginx_ingress_controller:3.6.1
F5 » Nginx Ingress Controller » Version: 3.6.2

cpe:2.3:a:f5:nginx_ingress_controller:3.6.2
F5 » Nginx Ingress Controller » Version: 3.7.0

cpe:2.3:a:f5:nginx_ingress_controller:3.7.0
F5 » Nginx Ingress Controller » Version: 3.7.1

cpe:2.3:a:f5:nginx_ingress_controller:3.7.1
F5 » Nginx Ingress Controller » Version: 3.7.2

cpe:2.3:a:f5:nginx_ingress_controller:3.7.2
F5 » Nginx Ingress Controller » Version: 4.0.0

cpe:2.3:a:f5:nginx_ingress_controller:4.0.0
F5 » Nginx Ingress Controller » Version: 4.0.1

cpe:2.3:a:f5:nginx_ingress_controller:4.0.1
F5 » Nginx Ingress Controller » Version: 5.0.0

cpe:2.3:a:f5:nginx_ingress_controller:5.0.0
F5 » Nginx Ingress Controller » Version: 5.3.0

cpe:2.3:a:f5:nginx_ingress_controller:5.3.0
F5 » Nginx Ingress Controller » Version: 5.3.2

cpe:2.3:a:f5:nginx_ingress_controller:5.3.2
F5 » Nginx Ingress Controller » Version: 5.3.3

cpe:2.3:a:f5:nginx_ingress_controller:5.3.3
F5 » Nginx Ingress Controller » Version: 5.3.4

cpe:2.3:a:f5:nginx_ingress_controller:5.3.4
F5 » Nginx Ingress Controller » Version: 5.4.0

cpe:2.3:a:f5:nginx_ingress_controller:5.4.0
F5 » Nginx Ingress Controller » Version: 5.4.1

cpe:2.3:a:f5:nginx_ingress_controller:5.4.1
F5 » Nginx Ingress Controller » Version: 5.4.2

cpe:2.3:a:f5:nginx_ingress_controller:5.4.2
F5 » Nginx Instance Manager » Version: 2.16.0

cpe:2.3:a:f5:nginx_instance_manager:2.16.0
F5 » Nginx Instance Manager » Version: 2.17.0

cpe:2.3:a:f5:nginx_instance_manager:2.17.0
F5 » Nginx Instance Manager » Version: 2.17.1

cpe:2.3:a:f5:nginx_instance_manager:2.17.1
F5 » Nginx Instance Manager » Version: 2.17.2

cpe:2.3:a:f5:nginx_instance_manager:2.17.2
F5 » Nginx Instance Manager » Version: 2.17.3

cpe:2.3:a:f5:nginx_instance_manager:2.17.3
F5 » Nginx Instance Manager » Version: 2.17.4

cpe:2.3:a:f5:nginx_instance_manager:2.17.4
F5 » Nginx Instance Manager » Version: 2.18.0

cpe:2.3:a:f5:nginx_instance_manager:2.18.0
F5 » Nginx Instance Manager » Version: 2.19.0

cpe:2.3:a:f5:nginx_instance_manager:2.19.0
F5 » Nginx Instance Manager » Version: 2.19.1

cpe:2.3:a:f5:nginx_instance_manager:2.19.1
F5 » Nginx Instance Manager » Version: 2.21.0

cpe:2.3:a:f5:nginx_instance_manager:2.21.0
F5 » Nginx Open Source » Version: 1.19.0

cpe:2.3:a:f5:nginx_open_source:1.19.0
F5 » Nginx Open Source » Version: 1.19.1

cpe:2.3:a:f5:nginx_open_source:1.19.1
F5 » Nginx Open Source » Version: 1.19.10

cpe:2.3:a:f5:nginx_open_source:1.19.10
F5 » Nginx Open Source » Version: 1.19.2

cpe:2.3:a:f5:nginx_open_source:1.19.2
F5 » Nginx Open Source » Version: 1.19.3

cpe:2.3:a:f5:nginx_open_source:1.19.3
F5 » Nginx Open Source » Version: 1.19.4

cpe:2.3:a:f5:nginx_open_source:1.19.4
F5 » Nginx Open Source » Version: 1.19.5

cpe:2.3:a:f5:nginx_open_source:1.19.5
F5 » Nginx Open Source » Version: 1.19.6

cpe:2.3:a:f5:nginx_open_source:1.19.6
F5 » Nginx Open Source » Version: 1.19.7

cpe:2.3:a:f5:nginx_open_source:1.19.7
F5 » Nginx Open Source » Version: 1.19.8

cpe:2.3:a:f5:nginx_open_source:1.19.8
F5 » Nginx Open Source » Version: 1.19.9

cpe:2.3:a:f5:nginx_open_source:1.19.9
F5 » Nginx Open Source » Version: 1.21.0

cpe:2.3:a:f5:nginx_open_source:1.21.0
F5 » Nginx Open Source » Version: 1.21.1

cpe:2.3:a:f5:nginx_open_source:1.21.1
F5 » Nginx Open Source » Version: 1.21.2

cpe:2.3:a:f5:nginx_open_source:1.21.2
F5 » Nginx Open Source » Version: 1.21.3

cpe:2.3:a:f5:nginx_open_source:1.21.3
F5 » Nginx Open Source » Version: 1.21.4

cpe:2.3:a:f5:nginx_open_source:1.21.4
F5 » Nginx Open Source » Version: 1.21.5

cpe:2.3:a:f5:nginx_open_source:1.21.5
F5 » Nginx Open Source » Version: 1.21.6

cpe:2.3:a:f5:nginx_open_source:1.21.6
F5 » Nginx Open Source » Version: 1.23.0

cpe:2.3:a:f5:nginx_open_source:1.23.0
F5 » Nginx Open Source » Version: 1.23.1

cpe:2.3:a:f5:nginx_open_source:1.23.1
F5 » Nginx Open Source » Version: 1.23.2

cpe:2.3:a:f5:nginx_open_source:1.23.2
F5 » Nginx Open Source » Version: 1.23.3

cpe:2.3:a:f5:nginx_open_source:1.23.3
F5 » Nginx Open Source » Version: 1.23.4

cpe:2.3:a:f5:nginx_open_source:1.23.4
F5 » Nginx Open Source » Version: 1.25.0

cpe:2.3:a:f5:nginx_open_source:1.25.0
F5 » Nginx Open Source » Version: 1.25.1

cpe:2.3:a:f5:nginx_open_source:1.25.1
F5 » Nginx Open Source » Version: 1.25.2

cpe:2.3:a:f5:nginx_open_source:1.25.2
F5 » Nginx Open Source » Version: 1.25.3

cpe:2.3:a:f5:nginx_open_source:1.25.3
F5 » Nginx Open Source » Version: 1.25.4

cpe:2.3:a:f5:nginx_open_source:1.25.4
F5 » Nginx Open Source » Version: 1.25.5

cpe:2.3:a:f5:nginx_open_source:1.25.5
F5 » Nginx Open Source » Version: 1.26.1

cpe:2.3:a:f5:nginx_open_source:1.26.1
F5 » Nginx Open Source » Version: 1.26.2

cpe:2.3:a:f5:nginx_open_source:1.26.2
F5 » Nginx Open Source » Version: 1.27.0

cpe:2.3:a:f5:nginx_open_source:1.27.0
F5 » Nginx Open Source » Version: 1.27.1

cpe:2.3:a:f5:nginx_open_source:1.27.1
F5 » Nginx Open Source » Version: 1.27.2

cpe:2.3:a:f5:nginx_open_source:1.27.2
F5 » Nginx Open Source » Version: 1.27.3

cpe:2.3:a:f5:nginx_open_source:1.27.3
F5 » Nginx Open Source » Version: 1.27.4

cpe:2.3:a:f5:nginx_open_source:1.27.4
F5 » Nginx Open Source » Version: 1.27.5

cpe:2.3:a:f5:nginx_open_source:1.27.5
F5 » Nginx Open Source » Version: 1.28.2

cpe:2.3:a:f5:nginx_open_source:1.28.2
F5 » Nginx Open Source » Version: 1.28.3

cpe:2.3:a:f5:nginx_open_source:1.28.3
F5 » Nginx Open Source » Version: 1.29.0

cpe:2.3:a:f5:nginx_open_source:1.29.0
F5 » Nginx Open Source » Version: 1.29.1

cpe:2.3:a:f5:nginx_open_source:1.29.1
F5 » Nginx Open Source » Version: 1.29.2

cpe:2.3:a:f5:nginx_open_source:1.29.2
F5 » Nginx Open Source » Version: 1.29.3

cpe:2.3:a:f5:nginx_open_source:1.29.3
F5 » Nginx Open Source » Version: 1.29.4

cpe:2.3:a:f5:nginx_open_source:1.29.4
F5 » Nginx Open Source » Version: 1.29.5

cpe:2.3:a:f5:nginx_open_source:1.29.5
F5 » Nginx Open Source » Version: 1.29.6

cpe:2.3:a:f5:nginx_open_source:1.29.6
F5 » Nginx Open Source » Version: 1.29.7

cpe:2.3:a:f5:nginx_open_source:1.29.7
F5 » Nginx Open Source » Version: 1.29.8

cpe:2.3:a:f5:nginx_open_source:1.29.8
F5 » Nginx Open Source » Version: 1.30.0

cpe:2.3:a:f5:nginx_open_source:1.30.0
F5 » Nginx Plus » Version: r32

cpe:2.3:a:f5:nginx_plus:r32
F5 » Nginx Plus » Version: r33

cpe:2.3:a:f5:nginx_plus:r33
F5 » Nginx Plus » Version: r34

cpe:2.3:a:f5:nginx_plus:r34
F5 » Nginx Plus » Version: r35

cpe:2.3:a:f5:nginx_plus:r35
F5 » Nginx Plus » Version: r36

cpe:2.3:a:f5:nginx_plus:r36
F5 » Waf » Version: 4.10.0

cpe:2.3:a:f5:waf:4.10.0
F5 » Waf » Version: 4.11.0

cpe:2.3:a:f5:waf:4.11.0
F5 » Waf » Version: 4.12.0

cpe:2.3:a:f5:waf:4.12.0
F5 » Waf » Version: 4.13.0

cpe:2.3:a:f5:waf:4.13.0
F5 » Waf » Version: 4.14.0

cpe:2.3:a:f5:waf:4.14.0
F5 » Waf » Version: 4.15.0

cpe:2.3:a:f5:waf:4.15.0
F5 » Waf » Version: 4.16.0

cpe:2.3:a:f5:waf:4.16.0
F5 » Waf » Version: 4.9.0

cpe:2.3:a:f5:waf:4.9.0
F5 » Waf » Version: 5.1.0

cpe:2.3:a:f5:waf:5.1.0
F5 » Waf » Version: 5.10.0

cpe:2.3:a:f5:waf:5.10.0
F5 » Waf » Version: 5.11.0

cpe:2.3:a:f5:waf:5.11.0
F5 » Waf » Version: 5.11.1

cpe:2.3:a:f5:waf:5.11.1
F5 » Waf » Version: 5.12.0

cpe:2.3:a:f5:waf:5.12.0
F5 » Waf » Version: 5.12.1

cpe:2.3:a:f5:waf:5.12.1
F5 » Waf » Version: 5.2.0

cpe:2.3:a:f5:waf:5.2.0
F5 » Waf » Version: 5.3.0

cpe:2.3:a:f5:waf:5.3.0
F5 » Waf » Version: 5.4.0

cpe:2.3:a:f5:waf:5.4.0
F5 » Waf » Version: 5.5.0

cpe:2.3:a:f5:waf:5.5.0
F5 » Waf » Version: 5.6.0

cpe:2.3:a:f5:waf:5.6.0
F5 » Waf » Version: 5.7.0

cpe:2.3:a:f5:waf:5.7.0
F5 » Waf » Version: 5.8.0

cpe:2.3:a:f5:waf:5.8.0
F5 » Waf » Version: 5.9.0

cpe:2.3:a:f5:waf:5.9.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-40701

Products

Pricing

Contact Us