UpHeron
All vulnerabilities

Servers and applications

CVE-2026-28753

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity
Medium 6.3
Published
24 Mar 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.28.3, 1.29.7
Sources
NVD

Affected software

SoftwareAffected versions
nginxServers and applications · cpe:a:f5:nginx_open_source
  • From 0.6.27 up to 0.9.7
  • From 1.0.0 before 1.28.3
  • From 1.29.0 before 1.29.7

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-28753
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-28753