Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-42934

Опубликовано: 13 мая 2026
Источник: nvd
CVSS3: 4.8
EPSS Низкий

Описание

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.

 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:f5:dos:*:*:*:*:*:nginx:*:*
Версия от 4.3.0 (включая) до 4.7.0 (включая)
cpe:2.3:a:f5:dos:4.8.0:*:*:*:*:nginx:*:*
cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*
Версия от 1.3.0 (включая) до 1.6.2 (включая)
cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*
Версия от 2.0.0 (включая) до 2.6.0 (включая)
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*
Версия от 3.5.0 (включая) до 3.7.2 (включая)
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*
Версия от 4.0.0 (включая) до 4.0.1 (включая)
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*
Версия от 5.0.0 (включая) до 5.4.2 (включая)
cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*
Версия от 2.16.0 (включая) до 2.22.0 (включая)
cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*
Версия от 0.3.50 (включая) до 0.9.7 (включая)
cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*
Версия от 1.0.0 (включая) до 1.30.0 (включая)
cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*
Версия от r32 (включая) до r36 (включая)
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*
Версия от 4.9.0 (включая) до 4.16.0 (включая)
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*
Версия от 5.1.0 (включая) до 5.8.0 (включая)
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*
Версия от 5.9.0 (включая) до 5.12.1 (включая)

EPSS

Процентиль: 50%
0.00717
Низкий

4.8 Medium

CVSS3

Дефекты

CWE-125

Связанные уязвимости

ubuntu логотип

CVE-2026-42934

CVSS3: 4.8
ubuntu
3 месяца назад

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

redhat логотип

CVE-2026-42934

CVSS3: 4.8
redhat
3 месяца назад

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

msrc логотип

CVE-2026-42934

CVSS3: 4.8
msrc
3 месяца назад

NGINX ngx_http_charset_module vulnerability

debian логотип

CVE-2026-42934

CVSS3: 4.8
debian
3 месяца назад

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ ...

github логотип

GHSA-6vmc-2wh4-77qp

CVSS3: 4.8
github
3 месяца назад

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

EPSS

Процентиль: 50%
0.00717
Низкий

4.8 Medium

CVSS3

Дефекты

CWE-125