CVE-2026-28753

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• CWE-93

• https://my.f5.com/manage/s/article/K000160367Vendor Advisory

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28740Gitea versions up to and including 1.26.2 allow Git LFS obje…7.1
• CVE-2026-28741Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 1…8.1
• CVE-2026-28742Naxclow devices use a uniform request-signing scheme based o…9.8
• CVE-2026-28744Gitea versions up to and including 1.26.1 allow Git smart HT…8.1
• CVE-2026-28747A weak key generation vulnerability exists in specific firmw…7.3
• CVE-2026-28751in OpenHarmony v6.0 and prior versions allow a local attacke…3.3
• CVE-2026-28754Zohocorp ManageEngine Exchange Reporter Plus versions before…4.8
• CVE-2026-28755NGINX Plus and NGINX Open Source have a vulnerability in the…5.4
• CVE-2026-28756Zohocorp ManageEngine Exchange Reporter Plus versions before…4.8
• CVE-2026-28757Protection mechanism failure for some Intel(R) Workload Serv…5.4
• CVE-2026-28758When BIG-IP DNS is provisioned, a vulnerability exists in th…6.7
• CVE-2026-28759Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…4.3