{
  "threat_severity" : "Moderate",
  "public_date" : "2026-05-13T14:12:45Z",
  "bugzilla" : {
    "description" : "nginx: NGINX: Authorization bypass via IP spoofing in HTTP/3 QUIC module",
    "id" : "2477113",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2477113"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-290",
  "details" : [ "When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "A flaw was found in NGINX Plus and NGINX Open Source when configured to use the HTTP/3 QUIC module. A remote attacker could exploit this by spoofing their source IP address. This vulnerability allows for the bypass of authorization controls or rate limiting mechanisms, potentially leading to unauthorized access or resource abuse." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-05-23T00:00:00Z",
    "advisory" : "RHSA-2026:20351",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nginx-main-1.30.2-1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "nginx",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "nginx:1.24/nginx",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "nginx",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Out of support scope",
    "package_name" : "nginx:1.24/nginx",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Out of support scope",
    "package_name" : "nginx:1.26/nginx",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-40460\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40460\nhttps://my.f5.com/manage/s/article/K000161068" ],
  "name" : "CVE-2026-40460",
  "mitigation" : {
    "value" : "To mitigate this issue, if the HTTP/3 QUIC module is not required, disable it in your NGINX configuration. This typically involves removing or commenting out the `quic` parameter from `listen` directives in your `nginx.conf` file. After modifying the configuration, a graceful reload or restart of the NGINX service is required for the changes to take effect. For example, use `sudo systemctl reload nginx` or `sudo systemctl restart nginx`.",
    "lang" : "en:us"
  },
  "csaw" : false
}