CVE-2026-28753
Published: Mar 24, 2026
Modified: Mar 24, 2026
CVSS v3.1
3.7
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
| Vendor | Product | Versions |
|---|---|---|
F5 | NGINX Open Source | affected 1.29.0 - < 1.29.7affected 0.6.27 - < 1.28.3 |
F5 | NGINX Plus | affected R36 - < R36 P3affected R35 - < R35 P2affected R34 - < *affected R33 - < *affected R32 - < R32 P5 |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now