Vulnerability-Lookup

SUSE-SU-2026:22943-1

Vulnerability from csaf_suse - Published: 2026-07-24 07:41 - Updated: 2026-09-16 20:08

Summary

Security update for nginx

Severity

Important

Notes

Title of the patch: Security update for nginx

Description of the patch: This update for nginx fixes the following issues - CVE-2026-40460: bypass of authorization and bypass of rate limiting when NGINX is configured to use the HTTP/3 QUIC module (bsc#1265228). - CVE-2026-42055: heap-based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules (bsc#1268492). - CVE-2026-48142: heap buffer over-read in the ngx_http_charset_module module (bsc#1268495). - HTTP2-BOMB denial of service (bsc#1267525).

Patchnames: SUSE-SLES-16.0-1343

CVE-2026-40460

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 10 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 16.0:nginx-source-1.27.2-160000.6.1.noarch	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:nginx-source-1.27.2-160000.6.1.noarch	—	Vendor Fix

Threats

Impact moderate

CVE-2026-42055

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 10 products, the same list as for CVE-2026-40460

Threats

Impact important

CVE-2026-48142

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 10 products, the same list as for CVE-2026-40460

Threats

Impact moderate

References

17 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1265228	self
https://bugzilla.suse.com/1267525	self
https://bugzilla.suse.com/1268492	self
https://bugzilla.suse.com/1268495	self
https://www.suse.com/security/cve/CVE-2026-40460/	self
https://www.suse.com/security/cve/CVE-2026-42055/	self
https://www.suse.com/security/cve/CVE-2026-48142/	self
https://www.suse.com/security/cve/CVE-2026-40460	external
https://bugzilla.suse.com/1265228	external
https://www.suse.com/security/cve/CVE-2026-42055	external
https://bugzilla.suse.com/1268492	external
https://www.suse.com/security/cve/CVE-2026-48142	external
https://bugzilla.suse.com/1268495	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nginx",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nginx fixes the following issues\n\n- CVE-2026-40460: bypass of authorization and bypass of rate limiting when NGINX is configured to use the HTTP/3 QUIC module (bsc#1265228).\n- CVE-2026-42055: heap-based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules (bsc#1268492).\n- CVE-2026-48142: heap buffer over-read in the ngx_http_charset_module module (bsc#1268495).\n- HTTP2-BOMB denial of service (bsc#1267525).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLES-16.0-1343",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22943-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:22943-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622943-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:22943-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/028007.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1265228",
        "url": "https://bugzilla.suse.com/1265228"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1267525",
        "url": "https://bugzilla.suse.com/1267525"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268492",
        "url": "https://bugzilla.suse.com/1268492"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1268495",
        "url": "https://bugzilla.suse.com/1268495"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-40460 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-40460/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42055 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42055/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48142 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48142/"
      }
    ],
    "title": "Security update for nginx",
    "tracking": {
      "current_release_date": "2026-09-16T20:08:22Z",
      "generator": {
        "date": "2026-07-24T07:41:08Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:22943-1",
      "initial_release_date": "2026-07-24T07:41:08Z",
      "revision_history": [
        {
          "date": "2026-07-24T07:41:08Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T19:20:08Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T20:08:22Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.27.2-160000.6.1.aarch64",
                "product": {
                  "name": "nginx-1.27.2-160000.6.1.aarch64",
                  "product_id": "nginx-1.27.2-160000.6.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:f5:nginx:1.27.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/nginx@1.27.2-160000.6.1?arch=aarch64\u0026upstream=nginx-1.27.2-160000.6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-source-1.27.2-160000.6.1.noarch",
                "product": {
                  "name": "nginx-source-1.27.2-160000.6.1.noarch",
                  "product_id": "nginx-source-1.27.2-160000.6.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:f5:nginx:1.27.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/nginx-source@1.27.2-160000.6.1?arch=noarch\u0026upstream=nginx-1.27.2-160000.6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.27.2-160000.6.1.ppc64le",
                "product": {
                  "name": "nginx-1.27.2-160000.6.1.ppc64le",
                  "product_id": "nginx-1.27.2-160000.6.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:f5:nginx:1.27.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/nginx@1.27.2-160000.6.1?arch=ppc64le\u0026upstream=nginx-1.27.2-160000.6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.27.2-160000.6.1.s390x",
                "product": {
                  "name": "nginx-1.27.2-160000.6.1.s390x",
                  "product_id": "nginx-1.27.2-160000.6.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:f5:nginx:1.27.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/nginx@1.27.2-160000.6.1?arch=s390x\u0026upstream=nginx-1.27.2-160000.6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-1.27.2-160000.6.1.x86_64",
                "product": {
                  "name": "nginx-1.27.2-160000.6.1.x86_64",
                  "product_id": "nginx-1.27.2-160000.6.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:f5:nginx:1.27.2:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/nginx@1.27.2-160000.6.1?arch=x86_64\u0026upstream=nginx-1.27.2-160000.6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server 16.0",
                  "product_id": "SUSE Linux Enterprise Server 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.27.2-160000.6.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.aarch64"
        },
        "product_reference": "nginx-1.27.2-160000.6.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.27.2-160000.6.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.ppc64le"
        },
        "product_reference": "nginx-1.27.2-160000.6.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.27.2-160000.6.1.s390x as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.s390x"
        },
        "product_reference": "nginx-1.27.2-160000.6.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.27.2-160000.6.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.x86_64"
        },
        "product_reference": "nginx-1.27.2-160000.6.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.27.2-160000.6.1.noarch as component of SUSE Linux Enterprise Server 16.0",
          "product_id": "SUSE Linux Enterprise Server 16.0:nginx-source-1.27.2-160000.6.1.noarch"
        },
        "product_reference": "nginx-source-1.27.2-160000.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.27.2-160000.6.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.aarch64"
        },
        "product_reference": "nginx-1.27.2-160000.6.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.27.2-160000.6.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.ppc64le"
        },
        "product_reference": "nginx-1.27.2-160000.6.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.27.2-160000.6.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.s390x"
        },
        "product_reference": "nginx-1.27.2-160000.6.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-1.27.2-160000.6.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.x86_64"
        },
        "product_reference": "nginx-1.27.2-160000.6.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-source-1.27.2-160000.6.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
          "product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-source-1.27.2-160000.6.1.noarch"
        },
        "product_reference": "nginx-source-1.27.2-160000.6.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-40460",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-40460"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC  module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.    Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.s390x",
          "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:nginx-source-1.27.2-160000.6.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-source-1.27.2-160000.6.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-40460",
          "url": "https://www.suse.com/security/cve/CVE-2026-40460"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265228 for CVE-2026-40460",
          "url": "https://bugzilla.suse.com/1265228"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:nginx-source-1.27.2-160000.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-source-1.27.2-160000.6.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:nginx-source-1.27.2-160000.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-source-1.27.2-160000.6.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-24T07:41:08Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-40460"
    },
    {
      "cve": "CVE-2026-42055",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42055"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module  and ngx_http_grpc_module  modules. This vulnerability exists when the proxy_http_version to 2  or grpc_pass  directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers  directive is set to off, and the large_client_header_buffers  directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.s390x",
          "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:nginx-source-1.27.2-160000.6.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-source-1.27.2-160000.6.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42055",
          "url": "https://www.suse.com/security/cve/CVE-2026-42055"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268492 for CVE-2026-42055",
          "url": "https://bugzilla.suse.com/1268492"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:nginx-source-1.27.2-160000.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-source-1.27.2-160000.6.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:nginx-source-1.27.2-160000.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-source-1.27.2-160000.6.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-24T07:41:08Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42055"
    },
    {
      "cve": "CVE-2026-48142",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48142"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module  module. When content is served or proxied through a location block with both source_charset  utf-8; and a charset  directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.s390x",
          "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.x86_64",
          "SUSE Linux Enterprise Server 16.0:nginx-source-1.27.2-160000.6.1.noarch",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.aarch64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.s390x",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.x86_64",
          "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-source-1.27.2-160000.6.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48142",
          "url": "https://www.suse.com/security/cve/CVE-2026-48142"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268495 for CVE-2026-48142",
          "url": "https://bugzilla.suse.com/1268495"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:nginx-source-1.27.2-160000.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-source-1.27.2-160000.6.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.s390x",
            "SUSE Linux Enterprise Server 16.0:nginx-1.27.2-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server 16.0:nginx-source-1.27.2-160000.6.1.noarch",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.aarch64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.s390x",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-1.27.2-160000.6.1.x86_64",
            "SUSE Linux Enterprise Server for SAP applications 16.0:nginx-source-1.27.2-160000.6.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-24T07:41:08Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48142"
    }
  ]
}

CVE-2026-40460 (GCVE-0-2026-40460)

Vulnerability from cvelistv5 – Published: 2026-05-13 14:12 – Updated: 2026-05-13 16:06

Title

NGINX ngx_quic_module vulnerability

Summary

When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:54 UTC

CWE

CWE-290 - Authentication Bypass by Spoofing

Assigner

f5 mitre root

References

1 reference

URL	Tags
https://my.f5.com/manage/s/article/K000161068	vendor-advisorypatch

Impacted products

2 products

Vendor	Product	Version
F5	NGINX Plus	Unaffected: R37 , < * (custom) Affected: R36 , < R36 P4 (custom) Affected: R32 , < R32 P6 (custom)
F5	NGINX Open Source	Unaffected: 1.31.0 , < * (semver) Affected: 1.26.0 , < 1.30.1 (semver)

Date Public

2026-05-13 14:00

Credits

F5 acknowledges Rodrigo Laneth of Miralium Research for bringing this issue to our attention and following the highest standards of coordinated disclosure.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40460",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:54:59.053463Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T16:06:43.631Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "ngx_quic_module"
          ],
          "product": "NGINX Plus",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "R37",
              "versionType": "custom"
            },
            {
              "lessThan": "R36 P4",
              "status": "affected",
              "version": "R36",
              "versionType": "custom"
            },
            {
              "lessThan": "R32 P6",
              "status": "affected",
              "version": "R32",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "ngx_quic_module"
          ],
          "product": "NGINX Open Source",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.31.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.30.1",
              "status": "affected",
              "version": "1.26.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "F5 acknowledges Rodrigo Laneth of Miralium Research for bringing this issue to our attention and following the highest standards of coordinated disclosure."
        }
      ],
      "datePublic": "2026-05-13T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWhen NGINX Plus or NGINX Open Source are configured to use the \u003c/span\u003e\u003cstrong\u003eHTTP/3 QUIC\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.\u0026nbsp;\u0026nbsp;\u003c/span\u003eNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
            }
          ],
          "value": "When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC\u00a0module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290 Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T14:12:45.291Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://my.f5.com/manage/s/article/K000161068"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "NGINX ngx_quic_module vulnerability",
      "x_generator": {
        "engine": "F5 SIRTBot v1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2026-40460",
    "datePublished": "2026-05-13T14:12:45.291Z",
    "dateReserved": "2026-04-30T23:04:27.969Z",
    "dateUpdated": "2026-05-13T16:06:43.631Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42055 (GCVE-0-2026-42055)

Vulnerability from cvelistv5 – Published: 2026-06-17 14:04 – Updated: 2026-09-14 12:04 X_F5

Title

NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

Summary

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 00:00 UTC

CWE

CWE-122 - Heap-based Buffer Overflow
CWE-131 - Incorrect Calculation of Buffer Size

Assigner

f5 mitre root

References

13 references

URL	Tags
https://my.f5.com/manage/s/article/K000161584	vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-42055	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2489866	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:36364	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38847	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36618	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36331	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36639	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:46836	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27197	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44481	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:58981	vendor-advisoryx_refsource_REDHAT

Impacted products

15 products

Vendor	Product	Version
F5	NGINX Open Source	Affected: 1.13.10 , < 1.31.2 (custom) Affected: 1.30.2 , < 1.30.3 (custom)
F5	NGINX Plus	Affected: 37.0 , < 37.0.2.1 (custom) Affected: R36 , < R36 P6 (custom)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 2:1.26.3-6.el10_2.5 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260707171317.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.20.1-28.el9_8.4 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260707164406.9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260707110000.9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Discovery 2	Unaffected: 1784821750 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Hardened Images	Unaffected: 1.30.3-2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1784794818 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1784794778 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1784795076 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1787241211 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1787241260 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Openshift Data Foundation 4	cpe:/a:redhat:openshift_data_foundation:4

Date Public

2026-06-17 14:00

Credits

"F5 acknowledges Mufeed VH of Winfunc Research, Trung Nguyen (@everping) of CyStack, Feng Xue and XGPT of ThreatBook, Hcamael and 章鱼哥 of aipyapp, and Zhen Yan (AntAISecurityLab) for bringing this issue to our attention and following the highest standards of coordinated disclosure."

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42055",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-18T03:57:46.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "nginx",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2:1.26.3-6.el10_2.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nginx:1.24",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260707171317.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nginx",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2:1.20.1-28.el9_8.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nginx:1.24",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260707164406.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nginx:1.26",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260707110000.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:discovery:2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "discovery/discovery-ui-rhel9",
            "product": "Red Hat Discovery 2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784821750",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nginx-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.30.3-2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-kubernetes-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784794818",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784794778",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784795076",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-kubernetes-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787241211",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787241260",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-17T14:04:32.520Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in NGINX. When NGINX is configured to proxy HTTP/2 traffic using the ngx_http_proxy_v2_module or ngx_http_grpc_module with specific settings, a remote, unauthenticated attacker can send specially crafted large headers. This can trigger a heap-based buffer overflow, leading to a restart of the NGINX worker process and a Denial of Service (DoS). Under certain conditions, such as when Address Space Layout Randomization (ASLR) is disabled or bypassed, this vulnerability could also allow for arbitrary code execution."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-131",
                "description": "Incorrect Calculation of Buffer Size",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T12:04:28.530Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42055"
          },
          {
            "name": "RHBZ#2489866",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489866"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42055.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36364"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38847"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36618"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36331"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36639"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:46836"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27197"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44481"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:58981"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:36364: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38847: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36618: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36331: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36639: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:46836: Red Hat Discovery 2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27197: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44481: Red Hat Update Infrastructure 5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:58981: Red Hat Update Infrastructure 5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-17T16:01:41.848Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-17T14:04:32.520Z",
            "value": "Made public."
          }
        ],
        "title": "nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this vulnerability, ensure that the `ignore_invalid_headers` directive is set to `on` in your NGINX configuration, or reduce the size specified by the `large_client_header_buffers` directive to 2 megabytes or less. These changes require an NGINX service reload or restart to take effect. Reloading the NGINX service is generally safe, but a restart will briefly interrupt service."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "ngx_http_proxy_v2_module",
            "ngx_http_grpc_module"
          ],
          "product": "NGINX Open Source",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "1.31.2",
              "status": "affected",
              "version": "1.13.10",
              "versionType": "custom"
            },
            {
              "lessThan": "1.30.3",
              "status": "affected",
              "version": "1.30.2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "ngx_http_proxy_v2_module",
            "ngx_http_grpc_module"
          ],
          "product": "NGINX Plus",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "37.0.2.1",
              "status": "affected",
              "version": "37.0",
              "versionType": "custom"
            },
            {
              "lessThan": "R36 P6",
              "status": "affected",
              "version": "R36",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "\"F5 acknowledges Mufeed VH of Winfunc Research, Trung Nguyen (@everping) of CyStack, Feng Xue and XGPT of ThreatBook, Hcamael and \u7ae0\u9c7c\u54e5 of aipyapp, and Zhen Yan (AntAISecurityLab) for bringing this issue to our attention and following the highest standards of coordinated disclosure.\""
        }
      ],
      "datePublic": "2026-06-17T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eNGINX Plus and NGINX Open Source have a vulnerability in the \u003c/span\u003e\u003cstrong\u003engx_http_proxy_v2_module\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;and \u003c/span\u003e\u003cstrong\u003engx_http_grpc_module\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;modules. This vulnerability exists when the \u003c/span\u003e\u003cstrong\u003eproxy_http_version to 2\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;or \u003c/span\u003e\u003cstrong\u003egrpc_pass\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;directives are used to proxy HTTP/2 traffic, the \u003c/span\u003e\u003cstrong\u003eignore_invalid_headers\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;directive is set to off, and the \u003c/span\u003e\u003cstrong\u003elarge_client_header_buffers\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\u003c/span\u003e \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
            }
          ],
          "value": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module\u00a0and ngx_http_grpc_module\u00a0modules. This vulnerability exists when the proxy_http_version to 2\u00a0or grpc_pass\u00a0directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers\u00a0directive is set to off, and the large_client_header_buffers\u00a0directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T14:04:32.520Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://my.f5.com/manage/s/article/K000161584"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_F5"
      ],
      "title": "NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability",
      "x_generator": {
        "engine": "F5 SIRTBot v1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2026-42055",
    "datePublished": "2026-06-17T14:04:32.520Z",
    "dateReserved": "2026-06-02T21:45:04.818Z",
    "dateUpdated": "2026-09-14T12:04:28.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48142 (GCVE-0-2026-48142)

Vulnerability from cvelistv5 – Published: 2026-06-17 14:04 – Updated: 2026-06-17 15:42 X_F5

Title

NGINX ngx_http_charset_module vulnerability

Summary

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 15:42 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

f5 mitre root

References

1 reference

URL	Tags
https://my.f5.com/manage/s/article/K000161585	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
F5	NGINX Open Source	Affected: 1.13.10 , < 1.31.2 (custom) Affected: 1.30.0 , < 1.30.3 (custom)
F5	NGINX Plus	Affected: 37.0 , < 37.0.2.1 (custom) Affected: R36 , < R36 P6 (custom)

Date Public

2026-06-17 14:00

Credits

"F5 acknowledges p4p3r of CYBERONE and Han Yan of Xiaomi for bringing this issue to our attention and following the highest standards of coordinated disclosure."

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48142",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T15:42:46.410409Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T15:42:56.704Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "ngx_http_charset_module"
          ],
          "product": "NGINX Open Source",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "1.31.2",
              "status": "affected",
              "version": "1.13.10",
              "versionType": "custom"
            },
            {
              "lessThan": "1.30.3",
              "status": "affected",
              "version": "1.30.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "ngx_http_charset_module"
          ],
          "product": "NGINX Plus",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "37.0.2.1",
              "status": "affected",
              "version": "37.0",
              "versionType": "custom"
            },
            {
              "lessThan": "R36 P6",
              "status": "affected",
              "version": "R36",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "\"F5 acknowledges p4p3r of CYBERONE and Han Yan of Xiaomi for bringing this issue to our attention and following the highest standards of coordinated disclosure.\""
        }
      ],
      "datePublic": "2026-06-17T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eNGINX Plus and NGINX Open Source have a vulnerability in the \u003c/span\u003e\u003cstrong\u003engx_http_charset_module\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;module. When content is served or proxied through a location block with both \u003c/span\u003e\u003cstrong\u003esource_charset\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;utf-8; and a \u003c/span\u003e\u003cstrong\u003echarset\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;directive (for example, \u003c/span\u003e\u003cstrong\u003echarset koi8-r\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\u003c/span\u003e \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
            }
          ],
          "value": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module\u00a0module. When content is served or proxied through a location block with both source_charset\u00a0utf-8; and a charset\u00a0directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T14:04:32.856Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://my.f5.com/manage/s/article/K000161585"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_F5"
      ],
      "title": "NGINX ngx_http_charset_module vulnerability",
      "x_generator": {
        "engine": "F5 SIRTBot v1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2026-48142",
    "datePublished": "2026-06-17T14:04:32.856Z",
    "dateReserved": "2026-06-02T21:45:04.856Z",
    "dateUpdated": "2026-06-17T15:42:56.704Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2026:22943-1

CVE-2026-40460 (GCVE-0-2026-40460)

CVE-2026-42055 (GCVE-0-2026-42055)

CVE-2026-48142 (GCVE-0-2026-48142)

Tags

Sightings

Nomenclature

Related by attack behaviour