CVE-2026-28753

NGINX ngx_mail_proxy_module vulnerability

State: Published
Severity: 6.3 Medium
Published: Mar 24, 2026
Updated: Mar 24, 2026
Reserved: Mar 18, 2026

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	f5
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N	f5

Weaknesses

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

Affected Products

Product	Versions
NGINX Open SourceF5	1.29.0 to before 1.29.7Affected 0.6.27 to before 1.28.3Affected
NGINX PlusF5	R36 to before R36 P3Affected R35 to before R35 P2Affected R34 and laterAffected R33 and laterAffected R32 to before R32 P5Affected

References

https://my.f5.com/manage/s/article/K000160367vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.