CVE-2026-28753

Low

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

SeverityLow

CVSS3.7

Exploit probability—

Product

F5 Nginx Plus

PublishedMar 24, 2026

First seenMar 24, 2026

Weakness typeCWE-93CWE-93

How to fix

Update

f5 nginx_open_source1.28.3, 1.29.7 or later

Vendor advisories

my.f5.com/manage/s/article/K000160367

Affected products

Product	Affected versions	Fixed in
f5 nginx_plus	r32, r33, r34, r35, r36	—
f5 nginx_open_source	0.6.27 ≤ v ≤ 0.9.7, 1.0.0 ≤ v < 1.28.3, 1.29.0 ≤ v < 1.29.7	1.28.3, 1.29.7

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.