nginx: NGINX: Authorization bypass via IP spoofing in HTTP/3 QUIC module

🗓️ 23 May 2026 05:23:30Reported by RedHatType

Nginx authorization bypass via address spoofing in the HTTP protocol module may allow unauthorized access or resource abuse.

Reporter	Title	Published	Views	Family All 80
FreeBSD	nginx-devel -- multiple vulnerabilities	13 May 202600:00	–	freebsd
FreeBSD	www/nginx -- Remote Code Execution/DoS	14 May 202600:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-1714)	27 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2026-012 (ALASNGINX1-2026-012)	27 May 202600:00	–	nessus
Tenable Nessus	Debian dsa-6278 : libnginx-mod-http-geoip - security update	16 May 202600:00	–	nessus
Tenable Nessus	Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-094eb13bb1)	15 May 202600:00	–	nessus
Tenable Nessus	Fedora 42 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-38623b4fed)	15 May 202600:00	–	nessus
Tenable Nessus	Fedora 43 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-fb53cb4d67)	15 May 202600:00	–	nessus
Tenable Nessus	FreeBSD : nginx-devel -- multiple vulnerabilities (1ed77d8e-53bb-11f1-b339-3497f65b111b)	20 May 202600:00	–	nessus
Tenable Nessus	FreeBSD : www/nginx -- Remote Code Execution/DoS (3414ac89-4f9f-11f1-a1c0-0050569f0b83)	15 May 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	20251124	aarch64	nginx	1.30.2-1.hum1	nginx-1.30.2-1.hum1.aarch64.rpm
Red Hat Hardened Images	20251124	x86_64	nginx	1.30.2-1.hum1	nginx-1.30.2-1.hum1.x86_64.rpm
Red Hat Hardened Images	20251124	noarch	nginx-all-modules	1.30.2-1.hum1	nginx-all-modules-1.30.2-1.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-40460
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
my	www.my.f5.com/manage/s/article/K000161068
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-40460
cve	www.cve.org/CVERecord

15 Jul 2026 14:33Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.16.5

CVSS 46.9

EPSS0.00367

SSVC