CVE-2026-28753
published 2026-03-24CVE-2026-28753: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This…
PriorityP420low3.7CVSS 3.1
AVNACHPRNUINSUCNILAN
EPSS
0.26%
18.2th percentile
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nginx | < nginx 1.28.3-1 (forky) | nginx 1.28.3-1 (forky) |
| f5 | nginx | >= 0 < 1.28.3-1 | 1.28.3-1 |
| f5 | nginx_open_source | — | — |
| f5 | nginx_open_source | >= 0.6.27 < 1.28.3 | 1.28.3 |
| f5 | nginx_open_source | 0.6.27 – 0.9.7 | — |
| f5 | nginx_open_source | >= 1.0.0 < 1.28.3 | 1.28.3 |
| f5 | nginx_open_source | >= 1.29.0 < 1.29.7 | 1.29.7 |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | >= R32 < R32 P5 | R32 P5 |
| f5 | nginx_plus | >= R33 < * | * |
| f5 | nginx_plus | >= R34 < * | * |
| f5 | nginx_plus | >= R35 < R35 P2 | R35 P2 |
| f5 | nginx_plus | >= R36 < R36 P3 | R36 P3 |
| msrc | azl3_nginx_1.28.2-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_nginx_1.22.1-15_on_cbl_mariner_2.0 | — | — |
| ubuntu | nginx | — | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.3MEDIUM
vendor_debian6.3MEDIUM
vendor_redhat6.3MEDIUM
vendor_ubuntu6.3MEDIUM
vendor_msrc3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
nginx vulnerabilities
vendor_ubuntu·2026-06-03·CVSS 6.3
CVE-2026-1642 [MEDIUM] nginx vulnerabilities
Title: nginx vulnerabilities
Summary: Several security issues were fixed in nginx.
It was discovered that the nginx ngx_mail_smtp_module module incorrectly
handled certain memory operations when doing SMTP authentication. This
could possibly result in sensitive information being sent to the
authentication server. (CVE-2025-53859)
It was discovered that nginx incorrectly handled proxying to upstream TLS
servers. An attacker could possibly use this issue to insert plain text
data into the response from an upstream proxied server. (CVE-2026-1642)
It was discovered that the nginx ngx_mail_auth_http_module module
incorrectly handled certain requests. An attacker could possibly use this
issue to cause nginx to crash, resulting in a denial of service.
(CVE-2026-27651)
It was discovered that
Red Hat
NGINX: NGINX Plus: NGINX Open Source: NGINX Plus and NGINX Open Source: Request manipulation via header injection in SMTP upstream requests
vendor_redhat·2026-03-24·CVSS 6.3
CVE-2026-28753 [MEDIUM] CWE-93 NGINX: NGINX Plus: NGINX Open Source: NGINX Plus and NGINX Open Source: Request manipulation via header injection in SMTP upstream requests
NGINX: NGINX Plus: NGINX Open Source: NGINX Plus and NGINX Open Source: Request manipulation via header injection in SMTP upstream requests
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
A flaw was found in NGINX Plus and NGINX Open Source, specifically within the ngx_mail_smtp_module. This vulnerability allows an attacker-controlled DNS (Domain Name System) server to inject arbitrary headers into SMTP (Simple Mail Transfer Protocol) upstream requ
F5
CVE-2026-28753: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling...
vendor_f5·2026-03-24·CVSS 3.7
CVE-2026-28753 [MEDIUM] CWE-93 CVE-2026-28753: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling...
CVE-2026-28753: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling...
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Products: NGINX Plus, Nginx Open Source
Affected Versions: 0.6.27 - 0.9.7; 1.0.0 - 1.28.3; 1.29.0 - 1.29.7; r32; r33; r34; r35; r36
F5 Advisory Articles: K000160367
F5 References: https://my.f5.com/manage/s/article/K000160367
Microsoft
NGINX ngx_mail_proxy_module vulnerability
vendor_msrc·2026-03-10·CVSS 3.7
CVE-2026-28753 [MEDIUM] CWE-93 NGINX ngx_mail_proxy_module vulnerability
NGINX ngx_mail_proxy_module vulnerability
Mariner: Mariner
f5: f5
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2026-28753: nginx - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_modul...
vendor_debian·2026·CVSS 6.3
CVE-2026-28753 [MEDIUM] CVE-2026-28753: nginx - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_modul...
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 1.28.3-1)
sid: resolved (fixed in 1.28.3-1)
trixie: open
VulDB
F5 NGINX Open Source/NGINX Plus ngx_mail_smtp_module crlf injection (K000160367 / Nessus ID 306671)
vuldb·2026-04-17·CVSS 6.3
CVE-2026-28753 [MEDIUM] F5 NGINX Open Source/NGINX Plus ngx_mail_smtp_module crlf injection (K000160367 / Nessus ID 306671)
A vulnerability described as problematic has been identified in F5 NGINX Open Source and NGINX Plus. This vulnerability affects the function ngx_mail_smtp_module. Such manipulation leads to crlf injection.
This vulnerability is traded as CVE-2026-28753. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is recommended.
GHSA
GHSA-ggr6-fmr8-2m8g: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS respons
ghsa_unreviewed·2026-03-24
CVE-2026-28753 [MEDIUM] CWE-93 GHSA-ggr6-fmr8-2m8g: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS respons
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
OSV
CVE-2026-28753: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS respons
osv·2026-03-24·CVSS 6.3
CVE-2026-28753 [MEDIUM] CVE-2026-28753: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS respons
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-27651 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.7
CVE-2026-27651 [HIGH] CVE-2026-27651 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27651 :
NGINX vulnerability analysis and mitigation
When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 8.7
Score
Published March 24, 2026
Severity HIGH
CNA Score 8.7
Affected Technologies
NGINX
Nginx Plus
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 12.5
Exploitation Probability (EPSS) N/A
Affected
Wiz
CVE-2026-27784 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-27784 [HIGH] CVE-2026-27784 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27784 :
NGINX vulnerability analysis and mitigation
The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 8.5
Score
Published March 24, 2026
Severity HIGH
CNA Score 8.
Wiz
CVE-2026-27654 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-27654 [HIGH] CVE-2026-27654 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27654 :
NGINX vulnerability analysis and mitigation
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access to the entire system. Note: Software versions which have reached End of Technical Sup
Wiz
CVE-2026-1642 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.2
CVE-2026-1642 [HIGH] CVE-2026-1642 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1642 :
NGINX vulnerability analysis and mitigation
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 8.2
Score
Published February 4, 2026
Severity HIGH
CNA Score 8.2
Affected Technologies
NGINX
Rocky Linux
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 3.4
Exploitation
Wiz
CVE-2026-32647 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.5
CVE-2026-32647 [HIGH] CVE-2026-32647 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-32647 :
NGINX vulnerability analysis and mitigation
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 8.5
Score
Published M
Wiz
CVE-2026-28753 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-28753 [HIGH] CVE-2026-28753 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28753 :
NGINX vulnerability analysis and mitigation
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 6.3
Score
Published March 24, 2026
Severity MEDIUM
CNA Score 6.3
Affected Technologies
NGINX
Nginx Plus
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 6.4
Exploitation Probability (EPSS) N/A
Affected packages and lib
Wiz
CVE-2026-28755 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-28755 [HIGH] CVE-2026-28755 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28755 :
NGINX vulnerability analysis and mitigation
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 5.3
Score
Published March 24, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
NGINX
Nginx Plus
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 2.5
Exploitation Probability (EPSS) N/A
Affec
Bugzilla
CVE-2026-28753 nginx: NGINX Plus and NGINX Open Source: Request manipulation via header injection in SMTP upstream requests [fedora-all]
bugzilla·2026-03-24·CVSS 6.3
CVE-2026-28753 [MEDIUM] CVE-2026-28753 nginx: NGINX Plus and NGINX Open Source: Request manipulation via header injection in SMTP upstream requests [fedora-all]
CVE-2026-28753 nginx: NGINX Plus and NGINX Open Source: Request manipulation via header injection in SMTP upstream requests [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-4de4d247a0 (nginx-1.28.3-1.fc44, nginx-mod-brotli-1.0.0~rc-7.fc44, and 5 more) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-4de4d247a0
---
FEDORA-2026-4de4d247a0 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDO
Bugzilla
CVE-2026-28753 NGINX: NGINX Plus: NGINX Open Source: NGINX Plus and NGINX Open Source: Request manipulation via header injection in SMTP upstream requests
bugzilla·2026-03-24·CVSS 3.7
CVE-2026-28753 [LOW] CVE-2026-28753 NGINX: NGINX Plus: NGINX Open Source: NGINX Plus and NGINX Open Source: Request manipulation via header injection in SMTP upstream requests
CVE-2026-28753 NGINX: NGINX Plus: NGINX Open Source: NGINX Plus and NGINX Open Source: Request manipulation via header injection in SMTP upstream requests
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
2026-03-24
Published