CVE-2026-48142

Executive Summary

CVE-2026-48142 is a medium-severity vulnerability in the NGINX ngx_http_charset_module module. The flaw allows a remote, unauthenticated attacker to trigger a heap buffer over-read when NGINX is configured with both source_charset utf-8; and a charset directive (e.g., charset koi8-r;) in a location block. This can lead to limited disclosure of heap memory or cause the NGINX worker process to restart (denial of service). The vulnerability is triggered by sending specially crafted requests under conditions beyond the attacker's control, making exploitation probabilistic. No public exploit code or proof-of-concept is available at this time. The EPSS score is 0.0%, indicating very low exploitation activity in the wild.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
• Base Score: 4.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited memory disclosure
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L) – worker process restart

Threat Level: Medium. The vulnerability requires specific configuration and conditions beyond the attacker's control, limiting exploit reliability. However, the lack of authentication and network accessibility makes it a potential vector for information disclosure and denial of service.

Deep Dive & Mechanics

The vulnerability resides in the ngx_http_charset_module module, which handles character set conversion for HTTP responses. When a location block is configured with both source_charset utf-8; and a charset directive (e.g., charset koi8-r;), NGINX attempts to convert the response body from UTF-8 to the target charset.

The heap buffer over-read occurs during the conversion process. The module reads from a source buffer (the response body) and writes to a destination buffer. Due to improper bounds checking, an attacker can craft a request that causes the module to read beyond the allocated source buffer, reading adjacent heap memory. This can result in:

• Limited memory disclosure: The over-read may include sensitive data from other parts of the heap, such as other request data, session tokens, or internal NGINX structures.
• Worker process restart: If the over-read triggers a segmentation fault or memory access violation, the worker process crashes and is automatically restarted by the master process, causing a temporary denial of service.

The vulnerability is triggered by sending a request that results in a response body that, when converted, causes the module to read past the buffer boundary. The exact conditions are complex and depend on the specific response content and the conversion algorithm.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code in ngx_http_charset_module.c likely lacks proper bounds checking when reading from the source buffer during character conversion. A simplified example:

// Vulnerable: no bounds check on src
while (src < src_end) {
    // Read from src, write to dst
    *dst++ = convert(*src++);
}

Patched Code (Conceptual): The patched code would include a bounds check to ensure src does not exceed src_end:

// Patched: bounds check added
while (src < src_end) {
    if (src >= src_end) break; // Additional safety
    *dst++ = convert(*src++);
}

Note: No official patch has been released by NGINX at this time. The above is a hypothetical fix based on the vulnerability description.

Exploitation & Lab Setup

Red Team

Prerequisites:

• NGINX instance with a location block configured with both source_charset utf-8; and charset koi8-r; (or another target charset).
• Ability to send HTTP requests to the vulnerable endpoint.

Exploitation Steps:

1. Identify a target NGINX server with the vulnerable configuration.
2. Craft a request that triggers a response body that, when converted from UTF-8 to the target charset, causes a heap buffer over-read.
3. Send the request repeatedly to increase the probability of triggering the vulnerability.
4. Monitor for worker process crashes (denial of service) or analyze response content for leaked heap memory.

Example Request (Hypothetical):

GET /vulnerable-endpoint HTTP/1.1
Host: target.com
Accept-Charset: utf-8

Note: No public exploit code is available. The exact request parameters depend on the specific response content and NGINX version.

Blue Team

Detection:

• Monitor for unusual worker process restarts or crashes.
• Analyze NGINX error logs for segmentation faults or memory-related errors.
• Look for requests that result in unexpected response sizes or content.

Mitigation:

• Remove or comment out the source_charset and charset directives from location blocks.
• Apply a Web Application Firewall (WAF) rule to block requests with suspicious Accept-Charset headers.
• Restrict access to vulnerable endpoints.

Lab Setup:

1. Install a vulnerable NGINX version (e.g., 1.24.0).
2. Configure a location block with the vulnerable directives:

location /vulnerable {
    source_charset utf-8;
    charset koi8-r;
    proxy_pass http://backend;
}

3. Set up a backend server that returns a response with a body that triggers the vulnerability.
4. Use a tool like curl or a custom script to send requests and observe behavior.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests with Accept-Charset: utf-8 header targeting vulnerable endpoints.
  • Unusual response sizes or content that may include leaked heap memory.
• System:
  • NGINX error logs containing messages like:
    • segfault at ...
    • memory access violation
    • worker process exited on signal 11
  • Frequent worker process restarts.
• File:
  • Core dump files generated by crashed worker processes.

Detection Engineering

YARA Rule

rule CVE_2026_48142_NGINX_Charset_Overread {
    meta:
        description = "Detects NGINX configuration files with vulnerable charset directives"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-48142"
    strings:
        $source_charset = "source_charset utf-8"
        $charset = /charset\s+koi8-r/
    condition:
        all of them
}

Sigma Rule

title: NGINX Charset Module Heap Over-Read Attempt
id: 8f7a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects potential exploitation attempts of CVE-2026-48142 via Accept-Charset header
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/vulnerable'
        cs-headers|contains: 'Accept-Charset: utf-8'
    condition: selection
falsepositives:
    - Legitimate use of Accept-Charset header
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-48142 NGINX Charset Heap Over-Read Attempt"; flow:to_server; content:"Accept-Charset|3a| utf-8"; http_header; content:"/vulnerable"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove vulnerable directives: If possible, remove source_charset utf-8; and charset directives from location blocks.
2. Apply WAF rules: Block requests with Accept-Charset: utf-8 header targeting sensitive endpoints.
3. Monitor logs: Watch for worker process crashes and memory errors.

Long-term Fix:

• Wait for an official patch from NGINX and apply it as soon as it becomes available.
• Upgrade to a patched version when released.

Workarounds:

• Use alternative character set conversion methods (e.g., via backend application).
• Disable the ngx_http_charset_module module if not needed.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or further analysis, contact threatintel@valtersit.com.