CVE-2026-48142

What it is

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

At a glance

Exploitability

Can be exploited over the network without logging in. Limited direct impact.

Exploit odds

0.7% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-06-17 15:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-08-11 15:03 UTC Last updatedMost recent change to the record

Details

Published

2026-06-17 15:16 UTC

Last modified

2026-08-11 15:03 UTC

Exploit probability

0.7% · EPSS, next 30 days

Weakness

CWE-125 · Out-of-bounds read

Record status

Analyzed

Affected

• f5 Dos ≤ 4.7.0
• f5 Dos 4.9.0
• f5 nginx Gateway Fabric ≤ 1.6.2
• f5 nginx Gateway Fabric ≤ 2.6.3
• f5 nginx Ingress Controller ≤ 3.7.2
• f5 nginx Ingress Controller ≤ 4.0.1
• f5 nginx Ingress Controller ≤ 5.5.0
• f5 nginx Instance Manager ≤ 2.22.0

Attack profile CVSS 4.0 · 6.3

Attack vector

Network

Complexity

High

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

Low

Integrity

None

Availability

Low