The vulnerability resides in NGINX's ngx_http_charset_module. When the module is configured with the charset, source_charset, and charset_map directives in combination with a proxy_pass that has buffering disabled, an unauthenticated attacker can send crafted HTTP requests that trigger a heap buffer over-read in the NGINX worker process. The over-read may expose portions of memory to the attacker or cause the worker to crash and restart, leading to limited information disclosure or a denial‑of‑service condition. This weakness is a heap buffer over-read (CWE‑125).

The affected products are F5 NGINX Open Source and F5 NGINX Plus. The advisory does not list specific vulnerable versions; any release that includes the ngx_http_charset_module and is configured with the described directives may be affected.

The CVSS score of 6.3 indicates a medium severity. EPSS information is not available, so the precise likelihood of exploitation is unknown, and the CVE is not listed in the CISA KEV catalog, which suggests that no large‑scale exploitation has been reported. The likely attack vector is inbound HTTP traffic to the vulnerable NGINX instance, requiring no authentication. The impact is limited memory disclosure or a worker restart, which can lead to a disruptive denial‑of‑service if the worker process crashes repeatedly.