CVE-2026-28753

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS respons...

Résumé

NGINX ngx_mail_proxy_module vulnerability

Description d'origine

La description telle que publiée par la source (souvent en anglais).

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami nginx-gateway

[{"type":"SEMVER","events":[{"introduced":"0.6.27"},{"fixed":"1.28.3"},{"introduced":"1.29.0"},{"fixed":"1.29.7"}]}]

Bitnami nginx

[{"type":"SEMVER","events":[{"introduced":"0.6.27"},{"fixed":"1.28.3"},{"introduced":"1.29.0"},{"fixed":"1.29.7"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Alpine Linux ALPINE-CVE-2026-28753 nginx Corrigé dans: 1.28.3-r0
Debian DEBIAN-CVE-2026-28753 nginx Corrigé dans: 1.18.0-6.1+deb11u6
Ubuntu UBUNTU-CVE-2026-28753 nginx Corrigé dans: 1.4.6-1ubuntu3.9+esm6

Références

advisory my.f5.com
web nvd.nist.gov