CVE-2026-40460

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40460
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-40460.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-40460
Aliases
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CGA (4)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (5)
openSUSE (2)
RHSA (1)
SUSE (2)
UBUNTU (1)
Related
openSUSE (2)
SUSE (2)
Published
2026-05-13T16:16:42Z
Modified
2026-08-12T04:20:41Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:f5:dos:*:*:*:*:*:nginx:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "4.3.0"
                },
                {
                    "last_affected":  "4.7.0"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "f5:dos"
        },
        {
            "cpes":  [
                "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "3.5.0"
                },
                {
                    "last_affected":  "3.7.2"
                },
                {
                    "introduced":  "4.0.0"
                },
                {
                    "last_affected":  "4.0.1"
                },
                {
                    "introduced":  "5.0.0"
                },
                {
                    "last_affected":  "5.4.2"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "f5:nginx_ingress_controller"
        },
        {
            "cpes":  [
                "cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "2.16.0"
                },
                {
                    "last_affected":  "2.22.0"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "f5:nginx_instance_manager"
        },
        {
            "cpes":  [
                "cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "r32"
                },
                {
                    "last_affected":  "r36"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "f5:nginx_plus"
        },
        {
            "cpes":  [
                "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "4.9.0"
                },
                {
                    "last_affected":  "4.16.0"
                },
                {
                    "introduced":  "5.1.0"
                },
                {
                    "last_affected":  "5.8.0"
                },
                {
                    "introduced":  "5.9.0"
                },
                {
                    "last_affected":  "5.12.1"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "f5:waf"
        },
        {
            "cpes":  [
                "cpe:2.3:a:f5:dos:4.8.0:*:*:*:*:nginx:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "4.8.0"
                },
                {
                    "last_affected":  "4.8.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "f5:dos"
        }
    ]
}
References

Affected packages

Git / github.com/nginx/nginx

Affected ranges

Type
GIT
Repo
https://github.com/nginx/nginx
Events
Introduced
05760b62e9799df559246af9f65c9e514617f558
Last Affected
6e14e954aaacce9a433d9b07b4653809c7594ab8
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "1.25.0"
        },
        {
            "last_affected":  "1.30.0"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

release-1.*
release-1.25.0
release-1.25.1
release-1.25.2
release-1.25.3
release-1.25.4
release-1.25.5
release-1.27.0
release-1.27.1
release-1.27.2
release-1.27.3
release-1.27.4
release-1.27.5
release-1.29.0
release-1.29.1
release-1.29.2
release-1.29.3
release-1.29.4
release-1.29.5
release-1.29.6
release-1.29.7
release-1.29.8
release-1.30.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-40460.json"

Git / github.com/nginx/nginx-gateway-fabric

Affected ranges

Type
GIT
Repo
https://github.com/nginx/nginx-gateway-fabric
Events
Introduced
3a372747333fb1db372af7cf0b18ed7eef7c91f7
Last Affected
532db6a20b2912fe397211eef9f8d564d46a4bdd
Introduced
7dad8b31e3f0c3eadce36fed8c276e83e6583d24
Last Affected
95a66d8cec0ce98e1985aeab728317c5ba7ec0c6
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "1.3.0"
        },
        {
            "last_affected":  "1.6.2"
        },
        {
            "introduced":  "2.0.0"
        },
        {
            "last_affected":  "2.6.0"
        }
    ],
    "source":  "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-40460.json"