Cyber Resilience

CVE-2026-48142

Memory Safety in F5 Nginx Ingress Controller 3.5.0 – 3.7.2

Published
17 June 2026
Modified
22 June 2026
Patch / advisory
CVSS Score v4 6.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0068 49th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-48142 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in F5 Nginx Ingress Controller. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can…

more

send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct remote exploitation of a public-facing NGINX application via crafted requests to trigger out-of-bounds read (CWE-125).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-42934Same product: F5 Dos
CVE-2026-42945Same product: F5 Dos
CVE-2026-40701Same product: F5 Dos
CVE-2026-40460Same product: F5 Dos
CVE-2026-42055Same product: F5 Dos
CVE-2026-42530Same product: F5 Nginx Gateway Fabric
CVE-2026-42926Same product: F5 Nginx Gateway Fabric
CVE-2026-42946Same product: F5 Dos
CVE-2025-24497Same vendor: F5
CVE-2025-61951Same vendor: F5

Affected Assets

f5
dos
4.9.0 · 4.3.0 — 4.7.0
f5
nginx gateway fabric
1.3.0 — 1.6.2 · 2.0.0 — 2.6.3
f5
nginx ingress controller
3.5.0 — 3.7.2 · 4.0.0 — 4.0.1 · 5.0.0 — 5.5.0
f5
nginx instance manager
2.17.0 — 2.22.0
f5
nginx open source
1.0.0 — 1.30.2 · 1.31.0 — 1.31.1
f5
nginx plus
37.0.0 — 37.0.1 · r33 — r36
f5
waf
4.10.0 — 4.16.0 · 5.2.0 — 5.8.0 · 5.9.0 — 5.13.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
  • CM-6 Configuration Settings
  • CM-7 Least Functionality
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires timely patching of the ngx_http_charset_module heap over-read flaw once a fix is released.

prevent

Enforces secure baseline settings that prohibit the unsafe combination of source_charset utf-8 and charset directives.

prevent

Disables the ngx_http_charset_module entirely when its functionality is not required, eliminating the vulnerable code path.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices such as bounds checking and memory-safe languages directly prevent out-of-bounds reads.

ID.RA-01 partial match
prevents

Vulnerability scanning and recording can discover instances of out-of-bounds reads after code is deployed.

PR.PS-02 partial match
prevents

Routine patching replaces vulnerable code containing out-of-bounds read flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development and acceptance includes fuzzing and static analysis that detect out-of-bounds read defects before release.

A.8.15 Logging partial match
detects

Logging can record evidence of an out-of-bounds read but does not prevent the weakness itself.

prevents

Secure development life cycle mandates input validation and bounds checking that directly prevent out-of-bounds reads.

prevents

Application security requirements include explicit bounds and memory-safety specifications that mitigate buffer over-reads.

prevents

Secure system architecture and engineering principles require memory-safe design patterns and runtime protections against out-of-bounds access.

prevents

Secure coding standards explicitly forbid unsafe pointer arithmetic and mandate bounds-checked reads, eliminating CWE-125.

References