PT-2026-27432 · F5 · Nginx Open Source+1

Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-28753

Positive Technologies · (AI Summary)

CVSS v3.1

3.7

Low

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions NGINX Plus and NGINX Open Source (affected versions not specified)

Description The software contains a flaw in the ngx mail smtp module module related to how it processes Carriage Return Line Feed (CRLF) sequences within DNS responses. An attacker controlling a DNS server could exploit this to inject custom headers into SMTP requests sent upstream, potentially manipulating those requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-28753

Affected Products

Nginx Open Source

Nginx Plus

References · 2

• https://my.f5.com/manage/s/article/K000160367 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28753 · Security Note