PT-2026-40648

🗓️ 13 May 2026 00:00:00Reported by Positive TechnologiesType

Nginx Plus or Nginx Open Source with HTTP/3 QUIC may allow address spoofing to bypass authorization or rate limiting.

Reporter	Title	Published	Views	Family All 77
FreeBSD	nginx-devel -- multiple vulnerabilities	13 May 202600:00	–	freebsd
FreeBSD	www/nginx -- Remote Code Execution/DoS	14 May 202600:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-1714)	27 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2026-012 (ALASNGINX1-2026-012)	27 May 202600:00	–	nessus
Tenable Nessus	Debian dsa-6278 : libnginx-mod-http-geoip - security update	16 May 202600:00	–	nessus
Tenable Nessus	Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-094eb13bb1)	15 May 202600:00	–	nessus
Tenable Nessus	Fedora 42 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-38623b4fed)	15 May 202600:00	–	nessus
Tenable Nessus	Fedora 43 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-fb53cb4d67)	15 May 202600:00	–	nessus
Tenable Nessus	FreeBSD : nginx-devel -- multiple vulnerabilities (1ed77d8e-53bb-11f1-b339-3497f65b111b)	20 May 202600:00	–	nessus
Tenable Nessus	FreeBSD : www/nginx -- Remote Code Execution/DoS (3414ac89-4f9f-11f1-a1c0-0050569f0b83)	15 May 202600:00	–	nessus

Source	Link
twitter	www.twitter.com/f1tym1/status/2055567582023889155
twitter	www.twitter.com/f1tym1/status/2055376247690059960
osv	www.osv.dev/vulnerability/BIT-nginx-gateway-2026-40460
ubuntu	www.ubuntu.com/security/CVE-2026-42946
osv	www.osv.dev/vulnerability/ALPINE-CVE-2026-40460
suse	www.suse.com/security/cve/CVE-2026-42926
ubuntu	www.ubuntu.com/security/CVE-2026-40460
suse	www.suse.com/security/cve/CVE-2026-42934
ubuntu	www.ubuntu.com/security/CVE-2026-40701
security-tracker	www.security-tracker.debian.org/tracker/CVE-2026-40460

09 Jun 2026 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 46.9

CVSS 3.16.5

EPSS0.00372

SSVC