CVE-2026-40460

MediumCVSS 6.5/10Last modified Oct 26, 2026

Description

When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
F5	NGINX Plus	>= R36, < R36 P4; >= R32, < R32 P6
F5	NGINX Open Source	>= 1.26.0, < 1.30.1

References

https://my.f5.com/manage/s/article/K000161068Vendor Advisory

Timeline

Published: May 13, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-404617.5Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthoriz CVE-2026-404626.5Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenti CVE-2026-404637.6WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allow CVE-2026-404645.4NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenti CVE-2026-404655.3NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter.CVE-2026-404668.8Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveM CVE-2026-404677.5Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It CVE-2026-404689.1Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting o CVE-2026-404699.1Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite CVE-2026-404709.9A critical XSS vulnerability affected hackage-server and hackage.haskell.org. HTML and JavaScript files provided in source packages or via CVE-2026-404719.6hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to CVE-2026-404729.9In hackage-server, user-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling s