nginx Resolver Use-After-Free in OCSP Stapling (CVE-2026-40701)

Metadata

Affected Target

Summary

nginx’s resolver contains a use-after-free that is reachable when a server is configured with ssl_stapling on;, ssl_stapling_verify on;, and a resolver directive — the combination that causes nginx to perform DNS resolution of the OCSP responder hostname on the OCSP stapling code path. This repository provides a Docker-based reproduction lab (an nginx 1.30.0 build from source, the last vulnerable release, plus a matching TLS configuration) that reaches the vulnerable configuration state; it documents the trigger conditions and points to the F5 advisory for the exact freed-then-reused sequence rather than shipping a weaponized memory-corruption trigger. This entry mirrors only the CVE-2026-40701-specific subset (the shared nginx base image plus the resolver-lab overlay) extracted from a larger multi-CVE nginx lab bundle.

Vulnerability Details

Root Cause

The nginx resolver’s internal state for an in-flight DNS resolution can be freed and later reused (use-after-free) when OCSP stapling is enabled together with a configured resolver, causing nginx to resolve the OCSP responder’s hostname through the same resolver code path exercised by the bug.

Attack Vector

1. Target an nginx instance (1.19.0–1.30.0) configured with ssl_stapling on;, ssl_stapling_verify on;, and a resolver directive.
2. Ensure the server’s certificate chain has an OCSP responder URL (AIA extension) that nginx must resolve via DNS.
3. Drive repeated TLS handshakes / OCSP responder resolutions against the target, using a resolver the attacker influences, to force the freed-then-reused resolver object to be exercised — the precise timing sequence is documented in the referenced F5 advisory rather than in this lab’s own code.
4. A successful trigger causes memory corruption in the nginx worker process, which can lead to a crash (DoS) or potentially further exploitation depending on heap layout.

Impact

Use-after-free memory corruption in the nginx worker process handling TLS/OCSP stapling; primary confirmed impact is denial of service (worker crash), with potential for further exploitation depending on heap state.

Environment / Lab Setup

Target:   nginx 1.30.0 (built from source) in Docker, TLS on :443 with ssl_stapling + resolver configured
Attacker: docker, curl/openssl s_client (or custom OCSP-responder DNS control per the F5 advisory for full trigger)

Proof of Concept

PoC Script

See Dockerfile.base (shared nginx 1.30.0 build), Dockerfile, and nginx.conf in this folder.

1
2
3
4

docker build -t nginx-vuln-base:1.30.0 -f Dockerfile.base .
docker build -t cve-2026-40701:1.30.0 .
docker run --rm -p 8443:443 cve-2026-40701:1.30.0
curl -k https://127.0.0.1:8443/

Building Dockerfile.base compiles nginx 1.30.0 from source; Dockerfile layers a self-signed certificate and the vulnerable nginx.conf (OCSP stapling + Docker’s embedded resolver at 127.0.0.11) on top, reproducing the reachable, vulnerable configuration for further UAF-triggering research per the F5 advisory.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected nginx worker process crashes/restarts correlated with TLS handshake volume
• Core dumps or segfault entries in system logs pointing at the resolver module
• Anomalous DNS query patterns for OCSP responder hostnames

Remediation

References

• Source repository
• F5 advisory
• nginx security advisories

Notes

Mirrored from https://github.com/edgecases-PurpleHax/cve-images on 2026-07-05. The source repository is a multi-CVE bundle of vulnerable lab images (nginx CVE-2026-42945, CVE-2026-42946, CVE-2026-40701, CVE-2026-42934, plus a DVWA image); only the base/ (shared nginx 1.30.0 build) and cve-2026-40701-resolver-lab/ subfolders relevant to CVE-2026-40701 were mirrored here, unrelated CVE labs from the bundle were not copied.