This vulnerability in the ngx_http_ssl_module of F5 NGINX Plus and NGINX Open Source arises under specific SSL configuration settings involving client certificate verification and OCSP stapling or resolver usage. When ssl_verify_client is enabled as "on" or "optional" and ssl_ocsp is enabled or leaf parameters are configured with a resolver, crafted requests can cause a heap-use-after-free error in the NGINX worker process. This may lead to limited data modification or cause the worker process to restart. The vulnerability is identified as CWE-416 (Use After Free) and has a CVSS 3.1 base score of 4.8, indicating medium severity. The affected versions include R32 and R36. The vendor has not yet provided an official fix or remediation guidance, and no exploits are currently known in the wild.

An unauthenticated attacker can exploit this vulnerability to cause a heap-use-after-free error in the NGINX worker process, potentially resulting in limited modification of data or a restart of the worker process. The impact is limited to confidentiality and availability with no indication of integrity compromise beyond limited data modification. The CVSS score of 4.8 reflects this moderate impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling ssl_ocsp or ssl_verify_client directives if feasible to avoid the vulnerable configuration. Monitor vendor communications for updates on patches or official mitigations.