CVEFinder.io

CVE-2026-48142

🔶 medium
Summary

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score
4.8
Medium
EPSS Score
0.7
Exploit Probability
Published Date
2026-06-17
First Seen: 2026-06-25
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 13.5% of all 365,890 vulnerabilities in our database.

#316,591
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jun 17, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
"F5 acknowledges p4p3r of CYBERONE and Han Yan of Xiaomi for bringing this issue to our attention and following the highest standards of coordinated disclosure." (reporter)
SSVC data provided by CISA
Last Modified 2026-08-11
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS Vector 4.0 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE IDs (Weakness Types)
CWE-125

📦 Affected Products 17

Vendor Product Status Affected Versions
f5 nginx_ingress_controller Affected
> 3.5.0 < 3.7.2
f5 nginx_ingress_controller Affected
> 4.0.0 < 4.0.1
f5 nginx_ingress_controller Affected
> 5.0.0 < 5.5.0
f5 nginx_plus Affected
> 37.0.0 < 37.0.1
f5 nginx_plus Affected
> 37.0.0.1 < 37.0.2.1
f5 nginx_plus Affected
> r33 < r36
f5 nginx_plus Affected
vr36
f5 nginx_instance_manager Affected
> 2.17.0 < 2.22.0
f5 nginx_open_source Affected
> 1.0.0 < 1.30.2
f5 nginx_open_source Affected
> 1.31.0 < 1.31.1
f5 nginx_gateway_fabric Affected
> 1.3.0 < 1.6.2
f5 nginx_gateway_fabric Affected
> 2.0.0 < 2.6.3
f5 dos Affected
> 4.3.0 < 4.7.0
f5 dos Affected
v4.9.0
f5 waf Affected
> 4.10.0 < 4.16.0
f5 waf Affected
> 5.9.0 < 5.13.1
f5 waf Affected
> 5.2.0 < 5.8.0

🔗 References 1

https://my.f5.com/manage/s/article/K000161585
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-42533 ⚠️ high 8.1 3.5 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expres... 2026-07-15
CVE-2026-52865 🔶 medium 6.5 0.3 When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with per... 2026-07-15
CVE-2026-55723 ⚠️ high 8.3 0.3 When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection... 2026-07-15
CVE-2026-56434 🔶 medium 6.5 0.5 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist w... 2026-07-15
CVE-2026-60065 ℹ️ low 3.7 0.3 When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filte... 2026-07-15
CVE-2026-60005 ⚠️ high 8.2 0.7 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and... 2026-07-15
These CVEs affect the same products