Medium severity6.5NVD Advisory· Published May 13, 2026· Updated Jun 29, 2026
CVE-2026-40460
CVE-2026-40460
Description
When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products
10- osv-coords8 versionspkg:apk/chainguard/nginx-mainlinepkg:apk/chainguard/nginx-stablepkg:apk/wolfi/nginx-mainlinepkg:apk/wolfi/nginx-stablepkg:bitnami/nginxpkg:bitnami/nginx-gatewaypkg:rpm/opensuse/nginx&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/nginx&distro=openSUSE%20Tumbleweed
< 1.31.0-r0+ 7 more
- (no CPE)range: < 1.31.0-r0
- (no CPE)range: < 1.30.1-r0
- (no CPE)range: < 1.31.0-r0
- (no CPE)range: < 1.30.1-r0
- (no CPE)range: >= 1.26.0, < 1.30.1
- (no CPE)range: >= 1.26.0, < 1.30.1
- (no CPE)range: < 1.27.2-160000.6.1
- (no CPE)range: < 1.31.0-1.1
Patches
Vulnerability mechanics
References
1- my.f5.com/manage/s/article/K000161068nvdVendor Advisory
News mentions
0No linked articles in our index yet.