CVE-2026-40460

6.5 Moyenne

Publiée le 13/05/2026 à 18:16 · Modifiée le 29/06/2026 à 16:17 · Analysée par le NVD · Source : f5sirt@f5.com

Description

When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Traduire en français

Produits concernés

F5 NGINX Plus
F5 NGINX Open Source
F5 dos
F5 nginx gateway fabric
F5 nginx ingress controller
F5 nginx instance manager
F5 waf

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.9 Moyenne	f5sirt@f5.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	6.5 Moyenne	f5sirt@f5.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L`

Faiblesses (CWE)

CWE-290

Références

https://my.f5.com/manage/s/article/K000161068 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories