PT-2026-40648 · F5+3 · Nginx Open Source+4

Published 2026-05-13 · Updated 2026-06-01 · CVE-2026-40460

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions NGINX Plus (affected versions not specified) NGINX Open Source (affected versions not specified)

Description When configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address. This can lead to the bypass of authorization or rate limiting mechanisms.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BDU:2026-06964

BIT-NGINX-2026-40460

BIT-NGINX-GATEWAY-2026-40460

CVE-2026-40460

ECHO-B094-3180-9B8A

OPENSUSE-SU-2026:10796-1

RHSA-2026:20351

USN-8354-1

Affected Products

Linuxmint

Nginx Open Source

Nginx Plus

Nginx

Ubuntu

References · 35

• https://osv.dev/vulnerability/BIT-nginx-2026-40460 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10796-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40460 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42934 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-9256 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40460 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-40460 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40460 · Security Note
• https://bdu.fstec.ru/vul/2026-06964 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2026-40460 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40460 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8354-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40701 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nginx-gateway-2026-40460 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40460 · Security Note