UpHeron
All vulnerabilities

Servers and applications

CVE-2026-40460

When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity
Medium 6.9
Published
13 May 2026
Last changed
29 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
nginxServers and applications · cpe:a:f5:nginx_open_source
  • From 1.25.0 up to 1.30.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-40460
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-40460