CVE-2026-28753CWE-93

NGINX ngx_mail_proxy_module vulnerability

Medium · published March 24, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
18.8
In the wild
Unconfirmed
What it is

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00275 · 18.8th percentile
Weakness
CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-03-24T14:13Z
EPSS history
Timeline
  • 24 MAR 14:13Z
    NGINX ngx_mail_proxy_module vulnerability
    cvelistv5