The vulnerability exists in the QUIC module of NGINX and allows an attacker to spoof the source IP address. This flaw can subvert authentication checks or bypass rate‑limiting controls, exposing the system to unauthorized actions or denial‑of‑service attacks. The weakness is an authorization failure (CWE‑290) and is rated a CVSS of 6.9.

Products affected are F5’s NGINX Open Source and NGINX Plus. No specific affected version range is provided in the advisory, and only versions still under Technical Support are considered vulnerable.

With no EPSS score available the exact exploitation probability is uncertain, but the medium severity score of 6.9 indicates a meaningful risk. The attack vector is likely network‑based over QUIC, and the advisory notes that IP spoofing can bypass both authorization and rate limiting. The vulnerability is not listed in the CISA KEV catalog, but the potential for widespread misuse remains.