NGINX ngx_quic_module vulnerability (CVE-2026-40460)
A vulnerability in the NGINX ngx_quic_module affects versions 1.26.0 up to but not including 1.30.1 when configured to use the HTTP/3 QUIC module. This flaw allows an attacker to spoof their source IP address, potentially bypassing authorization or rate limiting controls. The vulnerability is classified with medium severity. A patch is available to address this issue.
AI Analysis
Technical Summary
The NGINX ngx_quic_module vulnerability (CVE-2026-40460) occurs when NGINX Plus or NGINX Open Source is configured with the HTTP/3 QUIC module. An attacker can exploit this vulnerability to spoof their source IP address, which may allow bypassing authorization mechanisms or rate limiting. The affected versions are from 1.26.0 up to but excluding 1.30.1. The vulnerability is related to improper handling of source IP validation in the QUIC module. There is no CVSS score provided, but the severity is assessed as medium. A patch is available to remediate this issue.
Potential Impact
Exploitation of this vulnerability could allow an attacker to bypass authorization or rate limiting by spoofing their source IP address. This could lead to unauthorized access or abuse of services protected by these controls. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available for this vulnerability. Users should update NGINX to version 1.30.1 or later to remediate the issue. Follow vendor instructions for applying the update. Since this is not a cloud service, remediation is the responsibility of the system administrator.
NGINX ngx_quic_module vulnerability (CVE-2026-40460)
Description
A vulnerability in the NGINX ngx_quic_module affects versions 1.26.0 up to but not including 1.30.1 when configured to use the HTTP/3 QUIC module. This flaw allows an attacker to spoof their source IP address, potentially bypassing authorization or rate limiting controls. The vulnerability is classified with medium severity. A patch is available to address this issue.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The NGINX ngx_quic_module vulnerability (CVE-2026-40460) occurs when NGINX Plus or NGINX Open Source is configured with the HTTP/3 QUIC module. An attacker can exploit this vulnerability to spoof their source IP address, which may allow bypassing authorization mechanisms or rate limiting. The affected versions are from 1.26.0 up to but excluding 1.30.1. The vulnerability is related to improper handling of source IP validation in the QUIC module. There is no CVSS score provided, but the severity is assessed as medium. A patch is available to remediate this issue.
Potential Impact
Exploitation of this vulnerability could allow an attacker to bypass authorization or rate limiting by spoofing their source IP address. This could lead to unauthorized access or abuse of services protected by these controls. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available for this vulnerability. Users should update NGINX to version 1.30.1 or later to remediate the issue. Follow vendor instructions for applying the update. Since this is not a cloud service, remediation is the responsibility of the system administrator.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:20351
- Cve Count
- 1
- State
- PUBLISHED
Threat ID: 6a160991e29bf47b50654f44
Added to database: 05/26/2026, 20:58:57 UTC
Last enriched: 09/08/2026, 15:18:48 UTC
Last updated: 09/14/2026, 10:01:30 UTC
Views: 235
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.