CVE-2026-40701: NGINX ngx_http_ssl_module vulnerability
Last updated 6 June 2026
Other sources
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpsslmodule module when the sslverifyclient directive is set to "on" or "optional," and the sslocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.18.0-6.1+deb11u6Fixed in 1.22.1-9+deb12u7Fixed in 1.26.3-3+deb13u5Fixed in 1.30.1-3 - Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.18.0-6.1+deb11u6 - Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.22.1-9+deb12u7 - Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.26.3-3+deb13u5 - Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.30.1-3 - Configuration
Set ssl_verify_client to 'off' (avoid using 'on' or 'optional') in the server/location block to prevent the vulnerable configuration described.
NGINX ngx_http_ssl_module ssl_verify_client = off - Configuration
Set ssl_ocsp to 'off' and do not configure leaf OCSP parameters with a resolver (avoid enabling ssl_ocsp or leaf parameters with a resolver) to eliminate the vulnerable condition.
NGINX ngx_http_ssl_module ssl_ocsp = off
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40701?
CVE-2026-40701 has been assigned a high severity rating due to the potential for attackers to exploit it for unauthorized access.
How do I fix CVE-2026-40701?
To mitigate CVE-2026-40701, disable the ssl_verify_client directive or ensure that the ssl_ocsp directive is appropriately configured.
Which versions of NGINX are affected by CVE-2026-40701?
CVE-2026-40701 affects both NGINX Plus and NGINX Open Source when specific SSL configuration settings are applied.
What is the impact of CVE-2026-40701?
The impact of CVE-2026-40701 includes potential exposure of sensitive information and increased risk of security breaches.
Is there a workaround for CVE-2026-40701?
A temporary workaround for CVE-2026-40701 is to modify the SSL settings to disable client certificate verification as a risk mitigation measure.