CVE-2026-28753

LOW 3.7

NGINX ngx_mail_proxy_module vulnerability

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CWE	CWE-93
Vendor	f5
Product	nginx open source
Published	Mar 24, 2026
Last Updated	Mar 24, 2026

Stay Ahead of the Next One

Get instant alerts for f5 nginx open source

Be the first to know when new low vulnerabilities affecting f5 nginx open source are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

F5 / NGINX Open Source

1.29.0 < 1.29.7 0.6.27 < 1.28.3

F5 / NGINX Plus

R36 < R36 P3 R35 < R35 P2 R34 < * R33 < * R32 < R32 P5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

my.f5.com: https://my.f5.com/manage/s/article/K000160367

Credits

🔍 Asim Viladi Oglu Manizada 🔍 Colin Warren 🔍 Xiao Liu (Yunnan University) 🔍 Yuan Tan (UC Riverside) 🔍 Bird Liu (Lanzhou University)