CVE-2026-40460

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40460", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "state": "PUBLISHED", "assignerShortName": "f5", "dateReserved": "2026-04-30T23:04:27.969Z", "datePublished": "2026-05-13T14:12:45.291Z", "dateUpdated": "2026-05-13T16:06:43.631Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["ngx_quic_module"], "product": "NGINX Plus", "vendor": "F5", "versions": [{"lessThan": "*", "status": "unaffected", "version": "R37", "versionType": "custom"}, {"lessThan": "R36 P4", "status": "affected", "version": "R36", "versionType": "custom"}, {"lessThan": "R32 P6", "status": "affected", "version": "R32", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["ngx_quic_module"], "product": "NGINX Open Source", "vendor": "F5", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.31.0", "versionType": "semver"}, {"lessThan": "1.30.1", "status": "affected", "version": "1.26.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "F5 acknowledges Rodrigo Laneth of Miralium Research for bringing this issue to our attention and following the highest standards of coordinated disclosure."}], "datePublic": "2026-05-13T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">When NGINX Plus or NGINX Open Source are configured to use the </span><strong>HTTP/3 QUIC</strong><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.&nbsp;&nbsp;</span>Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "value": "When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC\u00a0module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2026-05-13T14:12:45.291Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://my.f5.com/manage/s/article/K000161068"}], "source": {"discovery": "EXTERNAL"}, "title": "NGINX ngx_quic_module vulnerability", "x_generator": {"engine": "F5 SIRTBot v1.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T15:54:59.053463Z", "id": "CVE-2026-40460", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T16:06:43.631Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40460", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "state": "PUBLISHED", "assignerShortName": "f5", "dateReserved": "2026-04-30T23:04:27.969Z", "datePublished": "2026-05-13T14:12:45.291Z", "dateUpdated": "2026-05-13T16:06:43.631Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["ngx_quic_module"], "product": "NGINX Plus", "vendor": "F5", "versions": [{"lessThan": "*", "status": "unaffected", "version": "R37", "versionType": "custom"}, {"lessThan": "R36 P4", "status": "affected", "version": "R36", "versionType": "custom"}, {"lessThan": "R32 P6", "status": "affected", "version": "R32", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["ngx_quic_module"], "product": "NGINX Open Source", "vendor": "F5", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.31.0", "versionType": "semver"}, {"lessThan": "1.30.1", "status": "affected", "version": "1.26.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "F5 acknowledges Rodrigo Laneth of Miralium Research for bringing this issue to our attention and following the highest standards of coordinated disclosure."}], "datePublic": "2026-05-13T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">When NGINX Plus or NGINX Open Source are configured to use the </span><strong>HTTP/3 QUIC</strong><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.&nbsp;&nbsp;</span>Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "value": "When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC\u00a0module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2026-05-13T14:12:45.291Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://my.f5.com/manage/s/article/K000161068"}], "source": {"discovery": "EXTERNAL"}, "title": "NGINX ngx_quic_module vulnerability", "x_generator": {"engine": "F5 SIRTBot v1.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40460", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T15:54:59.053463Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T16:06:39.133Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["ngx_quic_module"], "product": "NGINX Plus", "vendor": "F5", "versions": [{"lessThan": "*", "status": "unaffected", "version": "R37", "versionType": "custom"}, {"lessThan": "R36 P4", "status": "affected", "version": "R36", "versionType": "custom"}, {"lessThan": "R32 P6", "status": "affected", "version": "R32", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["ngx_quic_module"], "product": "NGINX Open Source", "vendor": "F5", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.31.0", "versionType": "semver"}, {"lessThan": "1.30.1", "status": "affected", "version": "1.26.0", "versionType": "semver"}]}], "source": "f5sirt@f5.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:dos:*:*:*:*:*:nginx:*:*", "matchCriteriaId": "0772572C-26F9-4FA4-B9E6-BA40ED59F569", "versionEndIncluding": "4.7.0", "versionStartIncluding": "4.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:dos:4.8.0:*:*:*:*:nginx:*:*", "matchCriteriaId": "C45452BD-7A86-48E7-8E1D-1B340FF70B3B", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*", "matchCriteriaId": "15B7F1FD-0C49-460F-9CB8-23DA730EC4BE", "versionEndIncluding": "1.6.2", "versionStartIncluding": "1.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A6AA23F-A7A1-43DE-AD67-0EB1249143A4", "versionEndIncluding": "2.6.0", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "10D5B143-4C1E-4626-8B49-3EA7160E9256", "versionEndIncluding": "3.7.2", "versionStartIncluding": "3.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "73A1CDBB-49F6-4AB6-AA67-542FD8017D6A", "versionEndIncluding": "4.0.1", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "607EEFA3-BE2A-4660-8C67-E6FC9799325F", "versionEndIncluding": "5.4.2", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "CBC31553-99DE-4155-A8E5-13A84FCCB610", "versionEndIncluding": "2.22.0", "versionStartIncluding": "2.16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D0CD5D1-FBBF-4E91-9FBA-DF7824383B9D", "versionEndIncluding": "1.30.0", "versionStartIncluding": "1.25.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*", "matchCriteriaId": "0B153576-468F-48C2-9BC8-922A938AB235", "versionEndIncluding": "r36", "versionStartIncluding": "r32", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*", "matchCriteriaId": "F365BA5A-42D7-4024-9143-06D4DEE31212", "versionEndIncluding": "4.16.0", "versionStartIncluding": "4.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*", "matchCriteriaId": "8D720985-9119-480E-929A-7D9D5C083628", "versionEndIncluding": "5.8.0", "versionStartIncluding": "5.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*", "matchCriteriaId": "DE69C522-7FCB-4452-8E33-FCC72D36BF94", "versionEndIncluding": "5.12.1", "versionStartIncluding": "5.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC\u00a0module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}, {"lang": "es", "value": "Cuando NGINX Plus o NGINX Open Source est\u00e1n configurados para usar el m\u00f3dulo HTTP/3 QUIC, un atacante podr\u00eda falsificar su direcci\u00f3n IP de origen, lo que permitir\u00eda la elusi\u00f3n de la autorizaci\u00f3n o de la limitaci\u00f3n de velocidad. Nota: Las versiones de software que han alcanzado el Fin del Soporte T\u00e9cnico (EoTS) no se eval\u00faan."}], "id": "CVE-2026-40460", "lastModified": "2026-10-26T17:10:03.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "f5sirt@f5.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f5sirt@f5.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40460", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T15:54:59.053463Z", "version": "2.0.3"}}]}, "published": "2026-05-13T16:16:42.823", "references": [{"source": "f5sirt@f5.com", "tags": ["Vendor Advisory"], "url": "https://my.f5.com/manage/s/article/K000161068"}], "sourceIdentifier": "f5sirt@f5.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}], "source": "f5sirt@f5.com", "type": "Secondary"}]}

{"bugzilla": {"description": "nginx: NGINX: Authorization bypass via IP spoofing in HTTP/3 QUIC module", "id": "2477113", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477113"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "status": "draft"}, "cwe": "CWE-290", "details": ["A flaw was found in NGINX Plus and NGINX Open Source when configured to use the HTTP/3 QUIC module. A remote attacker could exploit this by spoofing their source IP address. This vulnerability allows for the bypass of authorization controls or rate limiting mechanisms, potentially leading to unauthorized access or resource abuse."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, if the HTTP/3 QUIC module is not required, disable it in your NGINX configuration. This typically involves removing or commenting out the `quic` parameter from `listen` directives in your `nginx.conf` file. After modifying the configuration, a graceful reload or restart of the NGINX service is required for the changes to take effect. For example, use `sudo systemctl reload nginx` or `sudo systemctl restart nginx`."}, "name": "CVE-2026-40460", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "nginx", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "nginx:1.24/nginx", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nginx", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nginx:1.24/nginx", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nginx:1.26/nginx", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nginx", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-05-13T14:12:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-40460\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40460\nhttps://my.f5.com/manage/s/article/K000161068"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[1.31.0,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.26.0,1.30.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "NGINX Open Source", "source": "cna", "vendor": "F5"}, "product": "nginx_open_source", "vendor": "f5"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[R37,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[R36,R36 P4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[R32,R32 P6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "NGINX Plus", "source": "cna", "vendor": "F5"}, "product": "nginx_plus", "vendor": "f5"}], "created": "2026-05-13T16:45:44.560592+00:00", "updated": "2026-05-13T16:45:44.955653+00:00", "vendors": ["f5", "f5$PRODUCT$nginx_open_source", "f5$PRODUCT$nginx_plus"]}