Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-48142

Опубликовано: 17 июн. 2026
Источник: nvd
CVSS3: 4.8
EPSS Низкий

Описание

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:f5:dos:*:*:*:*:*:nginx:*:*
Версия от 4.3.0 (включая) до 4.7.0 (включая)
cpe:2.3:a:f5:dos:4.9.0:*:*:*:*:nginx:*:*
cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*
Версия от 1.3.0 (включая) до 1.6.2 (включая)
cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*
Версия от 2.0.0 (включая) до 2.6.3 (включая)
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*
Версия от 3.5.0 (включая) до 3.7.2 (включая)
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*
Версия от 4.0.0 (включая) до 4.0.1 (включая)
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*
Версия от 5.0.0 (включая) до 5.5.0 (включая)
cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*
Версия от 2.17.0 (включая) до 2.22.0 (включая)
cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*
Версия от 1.0.0 (включая) до 1.30.2 (включая)
cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*
Версия от 1.31.0 (включая) до 1.31.1 (включая)
cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*
Версия от 37.0.0 (включая) до 37.0.1 (включая)
cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*
Версия от r33 (включая) до r36 (включая)
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*
Версия от 4.10.0 (включая) до 4.16.0 (включая)
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*
Версия от 5.2.0 (включая) до 5.8.0 (включая)
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*
Версия от 5.9.0 (включая) до 5.13.1 (включая)

EPSS

Процентиль: 49%
0.00684
Низкий

4.8 Medium

CVSS3

Дефекты

CWE-125

Связанные уязвимости

CVSS3: 4.8
ubuntu
около 1 месяца назад

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS3: 4.8
redhat
около 1 месяца назад

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS3: 4.8
msrc
около 1 месяца назад

NGINX ngx_http_charset_module vulnerability

CVSS3: 4.8
debian
около 1 месяца назад

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ ...

CVSS3: 4.8
github
около 1 месяца назад

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

EPSS

Процентиль: 49%
0.00684
Низкий

4.8 Medium

CVSS3

Дефекты

CWE-125