PT-2026-50442 · F5 · Nginx Open Source+1

Publicado 2026-06-17 · Atualizado 2026-06-17 · CVE-2026-48142

Mitre

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

NGINX Plus and NGINX Open Source have a vulnerability in the ngx http charset module module. When content is served or proxied through a location block with both source charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2026-48142

Produtos afetados

Nginx Open Source

Nginx Plus

Referências · 5

• https://my.f5.com/manage/s/article/K000161585 · Aviso do Fabricante
• https://reddit.com/r/nginx/comments/1u8dt9o/nueva_versi%C3%B3n_1303_y_1312 · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2026-48142 · Nota de Segurança
• https://twitter.com/jedisct1/status/2067287414410719676 · Publicação no Twitter
• https://twitter.com/0x_codex/status/2067312441365848086 · Publicação no Twitter