The vulnerability originates in the ngx_mail_smtp_module, where improper handling of CRLF sequences in DNS responses allows an attacker-controlled DNS server to inject arbitrary SMTP headers into upstream requests. This can lead to manipulation of the SMTP command stream, including forged message headers or altered control flow, potentially enabling replay attacks, bypassing email authentication, or compromising email integrity. The weakness is classified under CWE‑93: Improper Handling of CRLF Sequences.

This flaw affects F5 NGINX Open Source and all NGINX Plus releases from R32 through R36, covering multiple patch levels (p1, p2, p3, p4, etc.) as listed in the CPE data. Versions that have reached End of Technical Support are excluded from the CVE assessment.

The CVSS base score is 6.3, indicating medium severity. The EPSS value of less than 1 % and the lack of inclusion in the CISA KEV catalog suggest a low likelihood of widespread exploitation. Exploitation requires control over a DNS server that NGINX queries during SMTP processing, meaning the attack vector is network-based and limited to deployments using untrusted DNS resolvers. Successful exploitation would allow an attacker to alter SMTP traffic and potentially compromise email confidentiality and integrity.