F5-K000161585: Medium severity F5 NGINX Plus vulnerability

Q: Which deployments are exposed to this issue?

Exposure requires a location block that both serves or proxies content and configures source_charset utf-8; together with a charset directive such as charset koi8-r;. Deployments without that combination are not described as affected by the available information.

Q: What does an attacker need to exploit it?

The attacker can be remote and unauthenticated and sends requests to the affected location. Exploitation also depends on conditions beyond the attacker's control, reflected in the high attack complexity rating.

Q: What is the likely impact of successful exploitation?

Successful exploitation can cause a heap buffer over-read in an NGINX worker process. The stated outcomes are limited memory disclosure or a worker restart, with no integrity impact indicated.

Q: What can be changed if patching is not immediately possible?

Review location blocks for the combination of source_charset utf-8; and a charset directive. Where operationally feasible, remove or avoid that configuration combination until a supported remediation can be applied.

Published Jun 17, 2026

Updated

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcharsetmodule module. When content is served or proxied through a location block with both sourcecharset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.

Affected Software

14 affected componentsFixes available

F5 NGINX Plus>=37.0.0<=37.0.1

37.0.2.1

F5 NGINX Plus=33

F5 NGINX Open Source>=1.31.0<=1.31.1, >=1.0.0<=1.30.2

1.31.21.30.3

F5 NGINX Instance Manager>=2.17.0<=2.22.0

F5 F5 WAF for NGINX>=5.9.0<=5.13.1

F5 NGINX App Protect WAF>=5.2.0<=5.8.0

F5 NGINX App Protect WAF>=4.10.0<=4.16.0

F5 F5 DoS for NGINX=4.9.0

F5 NGINX App Protect DoS>=4.3.0<=4.7.0

F5 NGINX Gateway Fabric>=2.0.0<=2.6.3

2.6.4

F5 NGINX Gateway Fabric>=1.3.0<=1.6.2

F5 NGINX Ingress Controller>=5.0.0<=5.5.0

5.5.1

F5 NGINX Ingress Controller>=4.0.0<=4.0.1

F5 NGINX Ingress Controller>=3.5.0<=3.7.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 37.0.2.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 36
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.21.30.3
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.6.4
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.5.1

Event History

Jun 17, 2026

Advisory Published

via F5·01:43 PM

Data Sourced

via F5·01:43 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Exposure requires a location block that both serves or proxies content and configures source_charset utf-8; together with a charset directive such as charset koi8-r;. Deployments without that combination are not described as affected by the available information.

What does an attacker need to exploit it?

The attacker can be remote and unauthenticated and sends requests to the affected location. Exploitation also depends on conditions beyond the attacker's control, reflected in the high attack complexity rating.

What is the likely impact of successful exploitation?

Successful exploitation can cause a heap buffer over-read in an NGINX worker process. The stated outcomes are limited memory disclosure or a worker restart, with no integrity impact indicated.

What can be changed if patching is not immediately possible?

Review location blocks for the combination of source_charset utf-8; and a charset directive. Where operationally feasible, remove or avoid that configuration combination until a supported remediation can be applied.

F5-K000161585: Medium severity F5 NGINX Plus vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

What can be changed if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of successful exploitation?

What can be changed if patching is not immediately possible?