8.7

CVE-2026-27651

NGINX ngx_mail_auth_http_module vulnerability

When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Nginx Open Source Version >= 0.5.15 <= 0.9.7
F5 ≫ Nginx Open Source Version >= 1.0.0 < 1.28.3
F5 ≫ Nginx Open Source Version >= 1.29.0 < 1.29.7
F5 ≫ Nginx Plus Version >= r33 < r35
F5 ≫ Nginx Plus Versionr32 Update-
F5 ≫ Nginx Plus Versionr32 Updatep1
F5 ≫ Nginx Plus Versionr32 Updatep2
F5 ≫ Nginx Plus Versionr32 Updatep3
F5 ≫ Nginx Plus Versionr32 Updatep4
F5 ≫ Nginx Plus Versionr35 Update-
F5 ≫ Nginx Plus Versionr35 Updatep1
F5 ≫ Nginx Plus Versionr36 Update-
F5 ≫ Nginx Plus Versionr36 Updatep1
F5 ≫ Nginx Plus Versionr36 Updatep2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.05% 0.136
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
f5sirt@f5.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
f5sirt@f5.com 8.7 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.