← Back

CVE-2026-42934

nvd nist
Published: May 13, 2026Modified: Jun 18, 2026

JSON object

Loading...
6.3
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: f5sirt@f5.com (Secondary)

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected (14)

F5
7 products
Dos
Nginx Gateway Fabric
Nginx Ingress Controller
Nginx Instance Manager
Nginx Open Source
Nginx Plus
Waf
Configuration A
14 vulnerable
Vulnerable SoftwareAffected Versions
F5
Dos
From 4.3.0 to 4.7.0
Dos
Version 4.8.0
F5
Nginx Gateway Fabric
From 1.3.0 to 1.6.2
Nginx Gateway Fabric
From 2.0.0 to 2.6.0
F5
Nginx Ingress Controller
From 3.5.0 to 3.7.2
Nginx Ingress Controller
From 4.0.0 to 4.0.1
Nginx Ingress Controller
From 5.0.0 to 5.4.2
Nginx Instance Manager
From 2.16.0 to 2.22.0
F5
Nginx Open Source
From 0.3.50 to 0.9.7
Nginx Open Source
From 1.0.0 to 1.30.0
Nginx Plus
From r32 to r36
F5
Waf
From 4.9.0 to 4.16.0
Waf
From 5.1.0 to 5.8.0
Waf
From 5.9.0 to 5.12.1

Related CWEs

CWE-125
Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.

References (1)

Source: f5sirt@f5.com
MitigationVendor Advisory

Timeline

No history available yet.