CVE-2026-28753

NGINX ngx_mail_proxy_module vulnerability

Published Mar 24, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Analysis

Technical impact

The vulnerability originates in the ngx_mail_smtp_module, where improper handling of CRLF sequences in DNS responses allows an attacker-controlled DNS server to inject arbitrary SMTP headers into upstream requests. This can lead to manipulation of the SMTP command stream, including forged message headers or altered control flow, potentially enabling replay attacks, bypassing email authentication, or compromising email integrity. The weakness is classified under CWE‑93: Improper Handling of CRLF Sequences.

Affected Systems

This flaw affects F5 NGINX Open Source and all NGINX Plus releases from R32 through R36, covering multiple patch levels (p1, p2, p3, p4, etc.) as listed in the CPE data. Versions that have reached End of Technical Support are excluded from the CVE assessment.

Risk and Exploitability

The CVSS base score is 6.3, indicating medium severity. The EPSS value of less than 1 % and the lack of inclusion in the CISA KEV catalog suggest a low likelihood of widespread exploitation. Exploitation requires control over a DNS server that NGINX queries during SMTP processing, meaning the attack vector is network-based and limited to deployments using untrusted DNS resolvers. Successful exploitation would allow an attacker to alter SMTP traffic and potentially compromise email confidentiality and integrity.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

NGINX Open Source

unknown

Version	Status	Constraints
`1.29.0`	affected	< 1.29.7
`0.6.27`	affected	< 1.28.3

NGINX Plus

unknown

Version	Status	Constraints
`R36`	affected	< R36 P3
`R35`	affected	< R35 P2
`R34`	affected	< *
`R33`	affected	< *
`R32`	affected	< R32 P5

Configuration 1 [-]

OR	cpe:2.3:a:f5:nginx_plus:r32:p1::::::
	cpe:2.3:a:f5:nginx_plus:r32:p2::::::
	cpe:2.3:a:f5:nginx_plus:r32:p3::::::
	cpe:2.3:a:f5:nginx_plus:r32:p4::::::
	cpe:2.3:a:f5:nginx_plus:r33:::::::*
	cpe:2.3:a:f5:nginx_plus:r33:p1::::::
	cpe:2.3:a:f5:nginx_plus:r33:p2::::::
	cpe:2.3:a:f5:nginx_plus:r33:p3::::::
	cpe:2.3:a:f5:nginx_plus:r34:::::::*
	cpe:2.3:a:f5:nginx_plus:r34:p1::::::
	cpe:2.3:a:f5:nginx_plus:r34:p2::::::
	cpe:2.3:a:f5:nginx_plus:r35:::::::*
	cpe:2.3:a:f5:nginx_plus:r35:p1::::::
	cpe:2.3:a:f5:nginx_plus:r36:::::::*
	cpe:2.3:a:f5:nginx_plus:r36:p1::::::
	cpe:2.3:a:f5:nginx_plus:r36:p2::::::

Configuration 2 [-]

OR	cpe:2.3:a:f5:nginx_open_source::::::::
	cpe:2.3:a:f5:nginx_open_source::::::::
	cpe:2.3:a:f5:nginx_open_source::::::::

No data.

Vendor Product Versions

Nginx Open Source

Version	Status	Scheme	Platform
`[1.29.0,1.29.7)`	affected	semver	—
`[0.6.27,1.28.3)`	affected	semver	—

Nginx Plus

Version	Status	Scheme	Platform
`[R36,R36 P3)`	affected	generic	—
`[R35,R35 P2)`	affected	generic	—
`[R34,*]`	affected	generic	—
`[R33,*]`	affected	generic	—
`[R32,R32 P5)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest vendor‑published patch for NGINX Open Source and NGINX Plus that fixes CRLF handling in ngx_mail_smtp_module.
If an upgrade cannot be performed immediately, disable the ngx_mail_smtp_module or configure NGINX to use a trusted DNS resolver to prevent malicious DNS responses.
Monitor SMTP traffic for unexpected headers and review logs for anomalous SMTP command sequences.
Verify that outbound DNS queries are made to a secure DNS provider and consider DNSSEC validation if supported.

Generated by OpenCVE AI on March 26, 2026 at 23:24 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4589-1	nginx security update
Ubuntu USN	USN-8375-1	nginx vulnerabilities

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.281% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://my.f5.com/manage/s/article/K000160367
https://nvd.nist.gov/vuln/detail/CVE-2026-28753
https://www.cve.org/CVERecord?id=CVE-2026-28753

History

Mar 26, 2026 9:30 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:f5:nginx_open_source:::::::: cpe:2.3:a:f5:nginx_plus:r32:p1:::::: cpe:2.3:a:f5:nginx_plus:r32:p2:::::: cpe:2.3:a:f5:nginx_plus:r32:p3:::::: cpe:2.3:a:f5:nginx_plus:r32:p4:::::: cpe:2.3:a:f5:nginx_plus:r33:::::::* cpe:2.3:a:f5:nginx_plus:r33:p1:::::: cpe:2.3:a:f5:nginx_plus:r33:p2:::::: cpe:2.3:a:f5:nginx_plus:r33:p3:::::: cpe:2.3:a:f5:nginx_plus:r34:::::::* cpe:2.3:a:f5:nginx_plus:r34:p1:::::: cpe:2.3:a:f5:nginx_plus:r34:p2:::::: cpe:2.3:a:f5:nginx_plus:r35:::::::* cpe:2.3:a:f5:nginx_plus:r35:p1:::::: cpe:2.3:a:f5:nginx_plus:r36:::::::* cpe:2.3:a:f5:nginx_plus:r36:p1:::::: cpe:2.3:a:f5:nginx_plus:r36:p2::::::

Mar 25, 2026 12:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		F5 F5 nginx Open Source F5 nginx Plus
Vendors & Products		F5 F5 nginx Open Source F5 nginx Plus

Mar 25, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-28753 https://www.cve.org/CVERecord?id=CVE-2026-28753
Metrics	threat_severity `None`	threat_severity `Low`

Mar 24, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 24, 2026 3:15 PM Description updated View changes

Type	Values Removed	Values Added
Description	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Mar 24, 2026 2:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Title		NGINX ngx_mail_proxy_module vulnerability
Weaknesses		CWE-93
References		https://my.f5.com/manage/s/article/K000160367
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}`