← Database

CVE-2026-40460

MEDIUM CVSS: 6.5 Published: 2026-05-13 Modified: 2026-06-29

Description

When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Platforms

F5 WafF5 DosF5 Nginx Open SourceF5 Nginx Ingress ControllerF5 Nginx Gateway FabricF5 Nginx PlusF5 Nginx Instance Manager

Weakness Type

CWE-290

References