{"id":"CVE-2026-40460","aliases":["ALPINE-CVE-2026-40460","AZL-86847","BELL-CVE-2026-40460","BIT-nginx-2026-40460","BIT-nginx-gateway-2026-40460","DEBIAN-CVE-2026-40460","EUVD-2026-29974","GHSA-h7rq-f9gq-mc8r","MGASA-2026-0156","RHSA-2026:20351","SUSE-SU-2026:22943-1","SUSE-SU-2026:22951-1","UBUNTU-CVE-2026-40460","USN-8354-1","openSUSE-SU-2026:10796-1","openSUSE-SU-2026:21439-1"],"status":"published","title":"NGINX ngx_quic_module vulnerability","description":"When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00373,"percentile":0.3156,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290"],"published":"2026-05-13T14:12:45Z","modified":"2026-10-28T02:30:38Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"nginx","fixed_in":["1.26.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nginx","fixed_in":["1.28.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nginx","fixed_in":["1.28.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nginx","fixed_in":["1.30.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nginx","fixed_in":["1.28.3-4"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nginx","fixed_in":["1.28.3-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nginx","fixed_in":["1.30.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx","fixed_in":["1.30.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx-gateway","fixed_in":["1.30.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nginx","fixed_in":["1.26.3-3+deb13u5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.30.0-4"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"nginx","fixed_in":["1.28.0-6ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"nginx","fixed_in":["1.28.3-2ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nginx","fixed_in":["1.18.0-6ubuntu14.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"nginx","fixed_in":["1.24.0-2ubuntu7.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0-r3"},{"fixed":"1.28.3-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.30.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"1.26.0"},{"fixed":"1.30.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx-gateway","ranges":[{"type":"SEMVER","events":[{"introduced":"1.26.0"},{"fixed":"1.30.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-3+deb13u5"}]}],"versions":["1.26.3-3","1.26.3-3+deb13u1","1.26.3-3+deb13u2","1.26.3-3+deb13u3","1.26.3-3+deb13u4"]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-4"}]}],"versions":["1.26.3-3","1.28.0-1","1.28.0-2","1.28.0-3","1.28.0-4","1.28.0-5","1.28.0-6","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.3-2","1.30.0-1","1.30.0-2","1.30.0-3"]},{"source":"osv","ecosystem":"Mageia:9","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.1-1.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-6ubuntu1.4"}]}],"versions":["1.26.3-2ubuntu1","1.26.3-3ubuntu1","1.26.3-3ubuntu2","1.26.3-3ubuntu3","1.28.0-3ubuntu1","1.28.0-4ubuntu1","1.28.0-6ubuntu1","1.28.0-6ubuntu1.1","1.28.0-6ubuntu1.2","1.28.0-6ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-2ubuntu1.2"}]}],"versions":["1.28.0-6ubuntu1","1.28.1-2ubuntu1","1.28.1-3ubuntu1","1.28.2-2ubuntu1","1.28.3-2ubuntu1","1.28.3-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-6ubuntu14.12"}]}],"versions":["1.18.0-6ubuntu11","1.18.0-6ubuntu12","1.18.0-6ubuntu14","1.18.0-6ubuntu14.1","1.18.0-6ubuntu14.2","1.18.0-6ubuntu14.3","1.18.0-6ubuntu14.4","1.18.0-6ubuntu14.5","1.18.0-6ubuntu14.6","1.18.0-6ubuntu14.7","1.18.0-6ubuntu14.8","1.18.0-6ubuntu14.10","1.18.0-6ubuntu14.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2ubuntu7.9"}]}],"versions":["1.24.0-1ubuntu1","1.24.0-2ubuntu1","1.24.0-2ubuntu2","1.24.0-2ubuntu3","1.24.0-2ubuntu4","1.24.0-2ubuntu6","1.24.0-2ubuntu7","1.24.0-2ubuntu7.1","1.24.0-2ubuntu7.3","1.24.0-2ubuntu7.4","1.24.0-2ubuntu7.5","1.24.0-2ubuntu7.6","1.24.0-2ubuntu7.7","1.24.0-2ubuntu7.8"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-6ubuntu1.4"}]}],"versions":["1.26.3-2ubuntu1","1.26.3-3ubuntu1","1.26.3-3ubuntu2","1.26.3-3ubuntu3","1.28.0-3ubuntu1","1.28.0-4ubuntu1","1.28.0-6ubuntu1","1.28.0-6ubuntu1.1","1.28.0-6ubuntu1.2","1.28.0-6ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-2ubuntu1.2"}]}],"versions":["1.28.0-6ubuntu1","1.28.1-2ubuntu1","1.28.1-3ubuntu1","1.28.2-2ubuntu1","1.28.3-2ubuntu1","1.28.3-2ubuntu1.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.2-160000.6.1"}]}],"bundled":3}],"products":[{"vendor":"f5","product":"dos"},{"vendor":"f5","product":"nginx open source"},{"vendor":"f5","product":"nginx plus"},{"vendor":"f5","product":"nginx_gateway_fabric"},{"vendor":"f5","product":"nginx_ingress_controller"},{"vendor":"f5","product":"nginx_instance_manager"},{"vendor":"f5","product":"nginx_open_source"},{"vendor":"f5","product":"nginx_plus"},{"vendor":"f5","product":"waf"}],"references":[{"url":"https://my.f5.com/manage/s/article/K000161068","tags":["vendor-advisory","patch","Vendor Advisory","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40460","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-h7rq-f9gq-mc8r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-40460","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-40460","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40460","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0156.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35529","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/13/7","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20351","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40460","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42926","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9256","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42530","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20351.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480746","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9256","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000161377","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477113","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40460","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489872","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42530","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42530","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000161616","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42926","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000161131","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622943-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1265228","tags":["report"]},{"url":"https://bugzilla.suse.com/1267525","tags":["report"]},{"url":"https://bugzilla.suse.com/1268492","tags":["report"]},{"url":"https://bugzilla.suse.com/1268495","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48142","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622951-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40460","tags":["report"]},{"url":"https://nginx.org/en/security_advisories.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8354-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-9256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-42934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-42946","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42946","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-40460","title":"NGINX ngx_quic_module vulnerability","description":"When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T14:12:45.291Z","modified":"2026-05-13T16:06:43.631Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-29974","description":"When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T14:12:45Z","modified":"2026-05-13T16:06:43Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:04:33.260537Z"}],"ghsa":[{"id":"GHSA-h7rq-f9gq-mc8r","title":"When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker...","description":"When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T18:30:55Z","modified":"2026-05-13T18:31:05Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:08:07.151918Z"}],"nvd":[{"id":"CVE-2026-40460","description":"When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:42.823Z","modified":"2026-10-26T17:10:03.27Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"ALPINE-CVE-2026-40460","description":"When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:42.823Z","modified":"2026-10-01T02:17:49.277422821Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-40460","status":"published","published":"2026-05-15T14:22:38.113046Z","modified":"2026-05-20T07:15:05.230136408Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-40460","description":"When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:42.823Z","modified":"2026-10-28T02:30:38.583383076Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"DEBIAN-CVE-2026-40460","description":"When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:42.823Z","modified":"2026-10-27T09:47:41.923610764Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"RHSA-2026:20351","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-26T10:07:21Z","modified":"2026-10-17T10:10:38Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"UBUNTU-CVE-2026-40460","description":"When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:00Z","modified":"2026-06-01T19:00:23.597088472Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"AZL-86847","title":"CVE-2026-40460 affecting package nginx for versions less than 1.28.3-4","description":"When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-13T16:16:42Z","modified":"2026-09-22T05:34:53Z","updated_at":"2026-11-02T15:28:10.677811Z"},{"id":"BIT-nginx-2026-40460","title":"NGINX ngx_quic_module vulnerability","description":"When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-15T08:50:00.787Z","modified":"2026-09-08T08:48:16.861796876Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-nginx-gateway-2026-40460","title":"NGINX ngx_quic_module vulnerability","description":"When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-05-15T08:50:03.016Z","modified":"2026-09-08T08:48:16.764852487Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"MGASA-2026-0156","title":"Updated nginx packages fix security vulnerabilities","description":"NGINX ngx_quic_module vulnerability. (CVE-2026-40460)\nNGINX ngx_http_ssl_module vulnerability. (CVE-2026-40701)\nNGINX ngx_http_proxy_v2_module vulnerability. (CVE-2026-42926)\nNGINX ngx_http_charset_module vulnerability. (CVE-2026-42934)\nNGINX ngx_http_rewrite_module vulnerability. (CVE-2026-42945)\nNGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability.\n(CVE-2026-42946)\n","status":"published","published":"2026-05-26T01:55:28Z","modified":"2026-05-26T02:00:04.269313969Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10796-1","title":"nginx-1.31.0-1.1 on GA media","description":"These are all security issues fixed in the nginx-1.31.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-16T00:00:00Z","modified":"2026-05-17T14:18:07.625976Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:21439-1","title":"Security update for nginx","description":"This update for nginx fixes the following issues\n\n- CVE-2026-40460: bypass of authorization and bypass of rate limiting when NGINX is configured to use the HTTP/3 QUIC module (bsc#1265228).\n- CVE-2026-42055: heap-based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules (bsc#1268492).\n- CVE-2026-48142: heap buffer over-read in the ngx_http_charset_module module (bsc#1268495).\n- HTTP2-BOMB denial of service (bsc#1267525).\n","status":"published","published":"2026-07-24T07:39:50Z","modified":"2026-07-26T18:24:09.262136013Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22943-1","title":"Security update for nginx","description":"This update for nginx fixes the following issues\n\n- CVE-2026-40460: bypass of authorization and bypass of rate limiting when NGINX is configured to use the HTTP/3 QUIC module (bsc#1265228).\n- CVE-2026-42055: heap-based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules (bsc#1268492).\n- CVE-2026-48142: heap buffer over-read in the ngx_http_charset_module module (bsc#1268495).\n- HTTP2-BOMB denial of service (bsc#1267525).\n","status":"published","published":"2026-07-24T07:41:08Z","modified":"2026-07-29T18:24:22.280520639Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:22951-1","title":"Security update for nginx","description":"This update for nginx fixes the following issues\n\n- CVE-2026-40460: bypass of authorization and bypass of rate limiting when NGINX is configured to use the HTTP/3 QUIC module (bsc#1265228).\n- CVE-2026-42055: heap-based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules (bsc#1268492).\n- CVE-2026-48142: heap buffer over-read in the ngx_http_charset_module module (bsc#1268495).\n- HTTP2-BOMB denial of service (bsc#1267525).\n","status":"published","published":"2026-07-24T07:41:08Z","modified":"2026-07-29T18:24:23.563580535Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"USN-8354-1","title":"nginx vulnerabilities","description":"It was discovered that nginx did not properly validate source addresses in\nthe HTTP/3 QUIC module. A remote attacker could possibly use this issue to\nbypass authorization checks or rate limiting. This issue only affected\nUbuntu 25.04 and Ubuntu 25.10. (CVE-2026-40460)\n\nIt was discovered that nginx contained a use-after-free vulnerability in\nthe ngx_http_ssl_module module when client certificate verification and\nOCSP validation were enabled. A remote attacker could use this issue to\ncause nginx to crash, resulting in a denial of service, or possibly modify\ndata in memory. (CVE-2026-40701)\n\nIt was discovered that nginx did not properly handle certain proxied\nresponses in the ngx_http_charset_module module. A remote attacker could\npossibly use this issue to obtain sensitive information or cause nginx to\ncrash, resulting in a denial of service. (CVE-2026-42934)\n\nIt was discovered that nginx did not properly process certain SCGI and\nuWSGI responses. An attacker able to perform a machine-in-the-middle attack\ncould possibly use this issue to obtain sensitive information or cause\nnginx to crash, resulting in a denial of service. (CVE-2026-42946)\n\nIt was discovered that nginx incorrectly handled certain rewrite rules in\nthe ngx_http_rewrite_module module. A remote attacker could use this issue\nto cause nginx to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2026-9256)","status":"published","published":"2026-06-01T13:52:07Z","modified":"2026-06-30T18:16:44.352666338Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}