Cyber Resilience

CVE-2026-42934

Memory Safety in F5 Nginx Ingress Controller 3.5.0 – 3.7.2

Published
13 May 2026
Modified
18 June 2026
Patch / advisory
CVSS Score v4 6.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0072 50th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-42934 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in F5 Nginx Ingress Controller. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 50% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to…

more

cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct unauthenticated remote exploitation of public-facing NGINX web server via crafted requests causing out-of-bounds read.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-48142Same product: F5 Dos
CVE-2026-42945Same product: F5 Dos
CVE-2026-40701Same product: F5 Dos
CVE-2026-40460Same product: F5 Dos
CVE-2026-42055Same product: F5 Dos
CVE-2026-42530Same product: F5 Nginx Gateway Fabric
CVE-2026-42926Same product: F5 Nginx Gateway Fabric
CVE-2026-42946Same product: F5 Dos
CVE-2025-24497Same vendor: F5
CVE-2025-61951Same vendor: F5

Affected Assets

f5
dos
4.8.0 · 4.3.0 — 4.7.0
f5
nginx gateway fabric
1.3.0 — 1.6.2 · 2.0.0 — 2.6.0
f5
nginx ingress controller
3.5.0 — 3.7.2 · 4.0.0 — 4.0.1 · 5.0.0 — 5.4.2
f5
nginx instance manager
2.16.0 — 2.22.0
f5
nginx open source
0.3.50 — 0.9.7 · 1.0.0 — 1.30.0
f5
nginx plus
r32 — r36
f5
waf
4.9.0 — 4.16.0 · 5.1.0 — 5.8.0 · 5.9.0 — 5.12.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
  • CM-6 Configuration Settings
  • SI-10 Information Input Validation
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires timely patching of the ngx_http_charset_module flaw that produces the out-of-bounds read.

prevent

Mandates secure baseline settings that avoid the exact charset + proxy_pass + buffering=off combination that triggers the vulnerability.

prevent

Requires input validation on HTTP requests to block malformed inputs that cause the heap buffer over-read.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices such as bounds checking and memory-safe languages directly prevent out-of-bounds reads.

ID.RA-01 partial match
prevents

Vulnerability scanning and recording can discover instances of out-of-bounds reads after code is deployed.

PR.PS-02 partial match
prevents

Routine patching replaces vulnerable code containing out-of-bounds read flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development and acceptance includes fuzzing and static analysis that detect out-of-bounds read defects before release.

A.8.15 Logging partial match
detects

Logging can record evidence of an out-of-bounds read but does not prevent the weakness itself.

prevents

Secure development life cycle mandates input validation and bounds checking that directly prevent out-of-bounds reads.

prevents

Application security requirements include explicit bounds and memory-safety specifications that mitigate buffer over-reads.

prevents

Secure system architecture and engineering principles require memory-safe design patterns and runtime protections against out-of-bounds access.

prevents

Secure coding standards explicitly forbid unsafe pointer arithmetic and mandate bounds-checked reads, eliminating CWE-125.

References