PT-2026-27432 · F5+4 · Nginx Plus+5

Bird Liu + 3 · Publicado 2026-03-24 · Atualizado 2026-06-03 · CVE-2026-28753

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions NGINX Plus and NGINX Open Source (affected versions not specified)

Description The software contains a flaw in the ngx mail smtp module module related to how it processes Carriage Return Line Feed (CRLF) sequences within DNS responses. An attacker controlling a DNS server could exploit this to inject custom headers into SMTP requests sent upstream, potentially manipulating those requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-93

Identificadores relacionados

BDU:2026-04822

BIT-NGINX-2026-28753

BIT-NGINX-GATEWAY-2026-28753

CVE-2026-28753

OPENSUSE-SU-2026:10423-1

RHSA-2026:8346

USN-8210-1

USN-8375-1

Produtos afetados

Linuxmint

Nginx Open Source

Nginx Plus

Nginx

Red Os

Ubuntu

Referências · 45

• https://osv.dev/vulnerability/USN-8210-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-42934 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2036505782959984845 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2026-42946 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-04822 · Nota de Segurança
• https://angie.software/angie/docs/oss_changes/#angie · Nota
• https://my.f5.com/manage/s/article/K000160367 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-8375-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2026:10423-1 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-nginx-cve-2026-28753-7.3 · Nota
• https://suse.com/security/cve/CVE-2026-27651 · Nota
• https://suse.com/security/cve/CVE-2026-27654 · Nota
• https://twitter.com/VulmonFeeds/status/2036516175484424603 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-28753 · Nota de Segurança
• https://osv.dev/vulnerability/BELL-CVE-2026-28753 · Aviso do Fabricante