CVE-2026-28753

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS respons...

Summary

NGINX ngx_mail_proxy_module vulnerability

Original description

The description as published by the source.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami nginx-gateway

[{"type":"SEMVER","events":[{"introduced":"0.6.27"},{"fixed":"1.28.3"},{"introduced":"1.29.0"},{"fixed":"1.29.7"}]}]

Bitnami nginx

[{"type":"SEMVER","events":[{"introduced":"0.6.27"},{"fixed":"1.28.3"},{"introduced":"1.29.0"},{"fixed":"1.29.7"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2026-28753 nginx Fixed in: 1.28.3-r0
Debian DEBIAN-CVE-2026-28753 nginx Fixed in: 1.18.0-6.1+deb11u6
Ubuntu UBUNTU-CVE-2026-28753 nginx Fixed in: 1.4.6-1ubuntu3.9+esm6

References

advisory my.f5.com
web nvd.nist.gov