Vulnerability · Published Mar 24, 2026 · Assigned by f5
CVE-2026-28753NGINX ngx_mail_proxy_module vulnerability
Low 3.7
In plain English
A low-severity security flaw in NGINX Open Source from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | nginx | 1.28.3-r0 | ALPINE-CVE-2026-28753 |
| Alpine:v3.23 | nginx | 1.28.3-r0 | ALPINE-CVE-2026-28753 |
| Alpine:v3.24 | nginx | 1.28.3-r0 | ALPINE-CVE-2026-28753 |
| Debian:12 | nginx | 1.22.1-9+deb12u5 | DEBIAN-CVE-2026-28753 |
| Debian:13 | nginx | 1.26.3-3+deb13u3 | DEBIAN-CVE-2026-28753 |
| Debian:14 | nginx | 1.28.3-1 | DEBIAN-CVE-2026-28753 |
| Ubuntu:22.04:LTS | nginx | 1.18.0-6ubuntu14.10 | UBUNTU-CVE-2026-28753 |
| Ubuntu:24.04:LTS | nginx | 1.24.0-2ubuntu7.7 | UBUNTU-CVE-2026-28753 |
| Ubuntu:25.10 | nginx | 1.28.0-6ubuntu1.2 | UBUNTU-CVE-2026-28753 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| F5 | NGINX Open Source | 1.29.0 – before 1.29.70.6.27 – before 1.28.3 |
| F5 | NGINX Plus | R36 – before R36 P3R35 – before R35 P2R34 – before *R33 – before *R32 – before R32 P5 |
Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://my.f5.com/manage/s/article/K000160367 vendor-advisory