Medium severity6.5NVD Advisory· Published May 13, 2026· Updated Jun 29, 2026
CVE-2026-40460
CVE-2026-40460
Description
When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products
6- osv-coords4 versionspkg:bitnami/nginxpkg:bitnami/nginx-gatewaypkg:rpm/opensuse/nginx&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nginx&distro=openSUSE%20Tumbleweed
>= 1.26.0, < 1.30.1+ 3 more
- (no CPE)range: >= 1.26.0, < 1.30.1
- (no CPE)range: >= 1.26.0, < 1.30.1
- (no CPE)range: < 1.27.2-160000.6.1
- (no CPE)range: < 1.31.0-1.1
Patches
Vulnerability mechanics
References
1- my.f5.com/manage/s/article/K000161068nvdVendor Advisory
News mentions
0No linked articles in our index yet.