CVE-2026-28753

描述

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

如何修補 CVE-2026-28753

要修補 CVE-2026-28753,請將受影響套件升級到下列已修補版本。

• Alpine/nginx—升級至 1.28.3-r0 或更新版本
• —升級至 1.28.3 或更新版本
• —升級至 1.28.3 或更新版本
• —升級至 1.18.0-6.1+deb11u6 或更新版本

CVE-2026-28753 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• from 0, < 1.28.3-r0
• >= 0.6.27, < 1.28.3, >= 1.29.0, < 1.29.7
• >= 0.6.27, < 1.28.3, >= 1.29.0, < 1.29.7
• from 0, < 1.18.0-6.1+deb11u6

CVSS 分數

參考連結(4)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-28753
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2026-28753
• WEBmy.f5.com/manage/s/article/K000160367
• WEBnvd.nist.gov/vuln/detail/CVE-2026-28753