The ngx_mail_auth_http_module flaw in NGINX Open Source and NGINX Plus causes worker processes to terminate upon receipt of certain undocumented requests, creating a denial‑of‑service condition for mail services. The weakness is a null pointer dereference (CWE‑476). When CRAM‑MD5 or APOP authentication is enabled, an authentication server that allows retries by returning an Auth‑Wait header can trigger this failure due to a bad request handling path inside the module.

Affected versions include all releases of F5’s NGINX Open Source and NGINX Plus that support the ngx_mail_auth_http_module, specifically the r32, r35, and r36 series and their patch‑level variants (p1, p2, p3, p4, etc.). End‑of‑Support releases were not evaluated, but any unpatched configuration with the module enabled could be vulnerable.

The CVSS score of 8.7 indicates high severity, while the EPSS score is below 1 %, suggesting a low probability of current exploitation. The entry is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could trigger the flaw by sending crafted authentication requests when CRAM‑MD5 or APOP is active and the upstream server returns an Auth‑Wait response header. The attack vector would be remote, requiring network access to the mail server, and successful exploitation would force worker process termination, disrupting service availability.