CVE-2026-48142
This Vulnerability has been fixed in the Never-Ending Support (NES) version offered by HeroDevs.
Overview
Ingress NGINX Controller is an ingress controller for Kubernetes that uses NGINX as a reverse proxy and load balancer. It embeds an NGINX Open Source build and generates NGINX configuration from Ingress objects and annotations, so an NGINX-layer flaw ships inside the controller image rather than being something the cluster operator compiled directly. It is one of the most widely deployed ingress controllers in production Kubernetes clusters, routing external HTTP/HTTPS traffic to Services running inside the cluster.
A heap buffer over-read (CVE-2026-48142) has been identified in the NGINX ngx_http_charset_module. It triggers when a location block is configured with both source_charset utf-8; and a charset directive (for example charset koi8-r;). A remote, unauthenticated request can then cause a heap buffer over-read in the worker process while decoding from UTF-8 via the charset map, leading to limited disclosure of worker-process memory or a worker restart. Unlike the heap-overflow siblings disclosed alongside it, the impact is a read, not a write, so it does not carry a direct path to code execution.
Per OWASP: a buffer over-read allows an attacker to read memory beyond the allocated bounds of a buffer, and at minimum to crash the receiving service; in network-exposed parsers it is a reliable denial-of-service and limited information-disclosure primitive.
This issue affects NGINX Open Source 0.3.50 through 1.31.1, and every downstream that compiles the affected module, including the upstream Ingress NGINX Controller v1.15.1. Upstream NGINX shipped the fix in 1.31.2 (mainline) and 1.30.3 (stable) on June 17, 2026. The Kubernetes ingress-nginx project retired in March 2026 at v1.15.1 and will not ship a release that absorbs the fix.
Why this matters for Ingress NGINX deployments
CVE-2026-48142 is materially less severe than the heap-overflow CVEs in the same NGINX batch: the impact is a memory over-read, not a write that can be ridden into code execution. It also depends on a specific, non-default charset configuration. But it is still an unauthenticated, network-reachable finding at the cluster edge, and for teams on upstream Ingress NGINX v1.15.1 it will show up as an open finding once NVD propagates the advisory, with no upstream release to close it. It is typically remediated together with the more serious CVE-2026-42055 from the same disclosure, in the same NES release.
Details
Module Info
- Product: NGINX (ngx_http_charset_module); compiled-in component of Ingress NGINX Controller
- Affected components: the charset-map UTF-8 decode path, reachable only in a location block configured with both source_charset utf-8; and a charset directive (for example charset koi8-r;)
- Affected versions: NGINX Open Source 0.3.50 through 1.31.1; Ingress NGINX Controller builds that link those versions, including upstream v1.15.1
- Upstream source repository: https://github.com/nginx/nginx
- Container image (community, affected): registry.k8s.io/ingress-nginx/controller
- Helm chart (community): https://kubernetes.github.io/ingress-nginx
- Distribution channels: container registry (registry.k8s.io), Helm, kubectl manifests
- Fixed in:
- nginx 1.31.2 (mainline) and 1.30.3 (stable), June 17, 2026 (upstream)
- NES for Ingress NGINX 1.15.6, merged June 19, 2026, which backports the upstream fix onto the controller's pinned NGINX baseline (see release notes)
Vulnerability Info
This Medium-severity vulnerability lives in the NGINX charset module, which converts response bodies between character encodings at request time.
When a location block declares both source_charset utf-8; and a target charset (for example charset koi8-r;), NGINX decodes the response from UTF-8 through the charset map before re-encoding it. The decode path does not correctly bound its reads against the input, so a specially handled response processed through this configuration can cause the worker to read past the end of a heap buffer. The bytes read from beyond the buffer can be returned or reflected, producing a limited disclosure of adjacent worker-process memory; alternatively the over-read can fault and restart the worker.
Because the flaw is an over-read rather than an over-write, it does not corrupt adjacent state in a way that can be steered into code execution. That is the key distinction from the heap-overflow CVEs disclosed alongside it, and the reason nginx.org tiers it "low" while F5's CNA CVSS places it in the Medium band.
Threat model for Ingress NGINX clusters: exposure requires a vulnerable build plus a location block configured with the specific source_charset utf-8; plus charset combination. No authentication is required. The primary impacts are a limited read of adjacent worker memory and a possible worker restart (denial of service); there is no write primitive and no direct path to code execution.
When successfully exploited, this vulnerability can lead to:
- Limited disclosure of adjacent worker-process memory, which can include fragments of other in-flight data on the same worker
- Worker-process restart, and, with repeated triggering, a limited denial-of-service effect
Severity and exploit conditions
nginx.org rates this "low" in its own advisory tiering. F5, acting as CNA, scores it in the Medium band: 6.3 on CVSS v4.0 and 4.8 on CVSS v3.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L). Either way it is materially less severe than the heap-overflow siblings from the same batch, because the impact is a memory over-read, not a write.
Exploitation status
There is no confirmed in-the-wild exploitation and no public proof of concept for CVE-2026-48142 at the time of writing. It is not listed in CISA's Known Exploited Vulnerabilities catalog.
Steps To Reproduce
- Stand up a controller running upstream Ingress NGINX v1.15.1 (or any NGINX build between 0.3.50 and 1.31.1).
- Configure a location block with both source_charset utf-8; and a charset directive to a different encoding (for example charset koi8-r;).
- Send a request whose handling exercises the UTF-8 decode path through the charset map.
- Observe a worker over-read: either limited adjacent-memory content surfacing in the response or a worker restart in the controller logs.
Proof Of Concept
No weaponized exploit code is published. The affected configuration and decode path described above are sufficient to determine exposure and remediate.
Mitigation
OSS Users
Users of upstream NGINX and Ingress NGINX should apply one of the following mitigations:
- Upgrade NGINX Open Source to 1.31.2 (mainline) or 1.30.3 (stable) and restart workers. The same release also fixes CVE-2026-42055 from the same batch.
- As a configuration stopgap on builds that cannot be patched immediately, remove the vulnerable combination by not pairing source_charset utf-8; with a differing charset directive in the same location block, breaking the trigger condition. Verify against the live configuration.
- For Ingress NGINX specifically, no upstream release will rebase against the patched NGINX because the project retired in March 2026. Sign up for post-EOL security support; HeroDevs customers get immediate access to a patched Ingress NGINX build.
NES Customers
HeroDevs Never-Ending Support for Ingress NGINX resolves CVE-2026-48142 in NES for Ingress NGINX 1.15.6 (merged June 19, 2026) by backporting the upstream fix onto the controller's pinned NGINX baseline. The release ships the fixes for both CVE-2026-48142 and CVE-2026-42055 as a drop-in replacement for upstream ingress-nginx v1.15.1. VEX statements ship with the release so scanners that consume OpenVEX or CycloneDX VEX surface the patched status. See the NES for Ingress NGINX release notes for image tags and Helm chart versions.
Related CVEs
- CVE-2026-42055: the Critical NGINX HTTP/2 and gRPC proxy heap overflow disclosed in the same June 17 batch; fixed in the same NES 1.15.6 release.
- CVE-2026-42533: the NGINX map/regex script-engine heap overflow that also lands on EOL Ingress NGINX.
- CVE-2026-42945: "NGINX Rift," the prior NGINX heap bug reported exploited in the wild within days of disclosure.
For the disclosure context, see the CVE-2026-42055 blog post, which covers this CVE as part of the same June 17 batch, and browse the full vulnerability directory.
Compliance impact
CVE-2026-48142 is Medium severity, but it is still an unauthenticated, network-reachable finding that scanners will flag on an EOL controller with no OSS fix. The same frameworks that pressure the more serious siblings apply: the EU Cyber Resilience Act's Article 14 reporting obligations (from September 11, 2026), DORA's ICT third-party risk requirements (in force since January 2025), PCI DSS 4.0's continuous-patching evidence expectation, and FedRAMP continuous monitoring. The NES release ships a documented patch trail plus VEX statements that scanners consume programmatically.
Taking Action
Supported NGINX users have a clean upgrade to 1.31.2 or 1.30.3, which closes this over-read together with the Critical CVE-2026-42055 from the same batch. Teams on the retired Ingress NGINX controller have no OSS fix. NES for Ingress NGINX 1.15.6 ships both fixes as a secure drop-in replacement, so you stay patched without a forklift upgrade. To scope coverage, see NES for Ingress NGINX or talk to our team.
Credits
- F5 (CNA; advisory and CVSS scoring)
- HeroDevs NES for Ingress NGINX engineering (downstream backport and rebuild)
References
