CVE-2026-28753

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS respons...

概要

NGINX ngx_mail_proxy_module vulnerability

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami nginx-gateway

[{"type":"SEMVER","events":[{"introduced":"0.6.27"},{"fixed":"1.28.3"},{"introduced":"1.29.0"},{"fixed":"1.29.7"}]}]

Bitnami nginx

[{"type":"SEMVER","events":[{"introduced":"0.6.27"},{"fixed":"1.28.3"},{"introduced":"1.29.0"},{"fixed":"1.29.7"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Alpine Linux ALPINE-CVE-2026-28753 nginx 修正版: 1.28.3-r0
Debian DEBIAN-CVE-2026-28753 nginx 修正版: 1.18.0-6.1+deb11u6
Ubuntu UBUNTU-CVE-2026-28753 nginx 修正版: 1.4.6-1ubuntu3.9+esm6

参照URL

advisory my.f5.com
web nvd.nist.gov