{"id":"CVE-2025-53859","aliases":["ALPINE-CVE-2025-53859","AZL-66308","AZL-66311","BELL-CVE-2025-53859","BIT-nginx-2025-53859","BIT-nginx-gateway-2025-53859","CLSA-2026-1785509707","CLSA-2026-1785922957","DEBIAN-CVE-2025-53859","EUVD-2025-24579","GHSA-2qmj-q2xc-85v8","MGASA-2025-0245","OESA-2025-2086","OESA-2025-2087","OESA-2025-2088","OESA-2025-2089","OESA-2025-2090","OESA-2025-2136","RHSA-2026:8346","SUSE-SU-2025:03089-1","SUSE-SU-2025:03243-1","SUSE-SU-2025:03444-1","UBUNTU-CVE-2025-53859","USN-7715-1","USN-8375-1","openSUSE-SU-2025:15449-1"],"status":"published","title":"NGINX ngx_mail_smtp_module vulnerability","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00439,"percentile":0.38566,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2025-08-13T14:46:55Z","modified":"2026-10-26T09:43:34Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"nginx","fixed_in":["1.28.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nginx","fixed_in":["1.28.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nginx","fixed_in":["1.28.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nginx","fixed_in":["1.22.1-14"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nginx","fixed_in":["1.25.4-5"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nginx","fixed_in":["1.22.1-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nginx","fixed_in":["1.28.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nginx","fixed_in":["1.28.2-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx","fixed_in":["1.29.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx-gateway","fixed_in":["1.29.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nginx","fixed_in":["1.22.1-9+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nginx","fixed_in":["1.26.3-3+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.28.0-3"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"nginx","fixed_in":["1.26.3-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"nginx","fixed_in":["1.21.5-10.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"nginx","fixed_in":["1.21.5-10.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"nginx","fixed_in":["1.24.0-6.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"nginx","fixed_in":["1.24.0-6.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"nginx","fixed_in":["1.21.5-8.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"nginx","fixed_in":["1.24.0-6.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","fixed_in":["1.4.6-1ubuntu3.9+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","fixed_in":["1.10.3-0ubuntu0.16.04.5+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nginx","fixed_in":["1.14.0-0ubuntu1.11+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nginx","fixed_in":["1.18.0-0ubuntu1.7+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nginx","fixed_in":["1.18.0-6ubuntu14.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"nginx","fixed_in":["1.24.0-2ubuntu7.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"nginx","fixed_in":["1.26.3-3ubuntu3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nginx","fixed_in":["1.29.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.4-5"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.22.1-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0-r3"},{"fixed":"1.28.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.28.2-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.0"},{"fixed":"1.29.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx-gateway","ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.0"},{"fixed":"1.29.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els13"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-9+deb12u3"}]}],"versions":["1.22.1-9","1.22.1-9+deb12u1","1.22.1-9+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-3+deb13u1"}]}],"versions":["1.26.3-3"]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-3"}]}],"versions":["1.26.3-3","1.28.0-1","1.28.0-2"]},{"source":"osv","ecosystem":"Mageia:9","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-10.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-10.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-6.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-6.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-8.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-6.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.0-1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1ubuntu3.9+esm6"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4","1.4.6-1ubuntu3.5","1.4.6-1ubuntu3.6","1.4.6-1ubuntu3.7","1.4.6-1ubuntu3.8","1.4.6-1ubuntu3.9","1.4.6-1ubuntu3.9+esm1","1.4.6-1ubuntu3.9+esm2","1.4.6-1ubuntu3.9+esm3","1.4.6-1ubuntu3.9+esm4","1.4.6-1ubuntu3.9+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.5+esm7"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1","1.10.3-0ubuntu0.16.04.5+esm2","1.10.3-0ubuntu0.16.04.5+esm3","1.10.3-0ubuntu0.16.04.5+esm4","1.10.3-0ubuntu0.16.04.5+esm5","1.10.3-0ubuntu0.16.04.5+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+esm2"}]}],"versions":["1.12.1-0ubuntu2","1.13.6-2ubuntu1","1.13.6-2ubuntu2","1.13.10-1ubuntu1","1.13.12-0ubuntu1","1.14.0-0ubuntu1","1.14.0-0ubuntu1.1","1.14.0-0ubuntu1.2","1.14.0-0ubuntu1.3","1.14.0-0ubuntu1.4","1.14.0-0ubuntu1.5","1.14.0-0ubuntu1.6","1.14.0-0ubuntu1.7","1.14.0-0ubuntu1.9","1.14.0-0ubuntu1.10","1.14.0-0ubuntu1.11","1.14.0-0ubuntu1.11+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+esm1"}]}],"versions":["1.16.1-0ubuntu2","1.16.1-0ubuntu3","1.17.5-0ubuntu1","1.17.6-0ubuntu1","1.17.7-0ubuntu1","1.17.8-0ubuntu1","1.17.8-0ubuntu2","1.17.8-0ubuntu3","1.17.9-0ubuntu1","1.17.9-0ubuntu2","1.17.9-0ubuntu3","1.17.10-0ubuntu1","1.18.0-0ubuntu1","1.18.0-0ubuntu1.2","1.18.0-0ubuntu1.3","1.18.0-0ubuntu1.4","1.18.0-0ubuntu1.5","1.18.0-0ubuntu1.6","1.18.0-0ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-6ubuntu14.7"}]}],"versions":["1.18.0-6ubuntu11","1.18.0-6ubuntu12","1.18.0-6ubuntu14","1.18.0-6ubuntu14.1","1.18.0-6ubuntu14.2","1.18.0-6ubuntu14.3","1.18.0-6ubuntu14.4","1.18.0-6ubuntu14.5","1.18.0-6ubuntu14.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2ubuntu7.5"}]}],"versions":["1.24.0-1ubuntu1","1.24.0-2ubuntu1","1.24.0-2ubuntu2","1.24.0-2ubuntu3","1.24.0-2ubuntu4","1.24.0-2ubuntu6","1.24.0-2ubuntu7","1.24.0-2ubuntu7.1","1.24.0-2ubuntu7.3","1.24.0-2ubuntu7.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-3ubuntu3"}]}],"versions":["1.26.3-2ubuntu1","1.26.3-3ubuntu1","1.26.3-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-6ubuntu14.7"}]}],"versions":["1.18.0-6ubuntu11","1.18.0-6ubuntu12","1.18.0-6ubuntu14","1.18.0-6ubuntu14.1","1.18.0-6ubuntu14.2","1.18.0-6ubuntu14.3","1.18.0-6ubuntu14.4","1.18.0-6ubuntu14.5","1.18.0-6ubuntu14.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2ubuntu7.5"}]}],"versions":["1.24.0-1ubuntu1","1.24.0-2ubuntu1","1.24.0-2ubuntu2","1.24.0-2ubuntu3","1.24.0-2ubuntu4","1.24.0-2ubuntu6","1.24.0-2ubuntu7","1.24.0-2ubuntu7.1","1.24.0-2ubuntu7.3","1.24.0-2ubuntu7.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1ubuntu3.9+esm6"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4","1.4.6-1ubuntu3.5","1.4.6-1ubuntu3.6","1.4.6-1ubuntu3.7","1.4.6-1ubuntu3.8","1.4.6-1ubuntu3.9","1.4.6-1ubuntu3.9+esm1","1.4.6-1ubuntu3.9+esm2","1.4.6-1ubuntu3.9+esm3","1.4.6-1ubuntu3.9+esm4","1.4.6-1ubuntu3.9+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.5+esm7"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1","1.10.3-0ubuntu0.16.04.5+esm2","1.10.3-0ubuntu0.16.04.5+esm3","1.10.3-0ubuntu0.16.04.5+esm4","1.10.3-0ubuntu0.16.04.5+esm5","1.10.3-0ubuntu0.16.04.5+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+esm2"}]}],"versions":["1.12.1-0ubuntu2","1.13.6-2ubuntu1","1.13.6-2ubuntu2","1.13.10-1ubuntu1","1.13.12-0ubuntu1","1.14.0-0ubuntu1","1.14.0-0ubuntu1.1","1.14.0-0ubuntu1.2","1.14.0-0ubuntu1.3","1.14.0-0ubuntu1.4","1.14.0-0ubuntu1.5","1.14.0-0ubuntu1.6","1.14.0-0ubuntu1.7","1.14.0-0ubuntu1.9","1.14.0-0ubuntu1.10","1.14.0-0ubuntu1.11","1.14.0-0ubuntu1.11+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+esm1"}]}],"versions":["1.16.1-0ubuntu2","1.16.1-0ubuntu3","1.17.5-0ubuntu1","1.17.6-0ubuntu1","1.17.7-0ubuntu1","1.17.8-0ubuntu1","1.17.8-0ubuntu2","1.17.8-0ubuntu3","1.17.9-0ubuntu1","1.17.9-0ubuntu2","1.17.9-0ubuntu3","1.17.10-0ubuntu1","1.18.0-0ubuntu1","1.18.0-0ubuntu1.2","1.18.0-0ubuntu1.3","1.18.0-0ubuntu1.4","1.18.0-0ubuntu1.5","1.18.0-0ubuntu1.6","1.18.0-0ubuntu1.7"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1-1.1"}]}]}],"products":[{"vendor":"f5","product":"nginx open source"},{"vendor":"f5","product":"nginx plus"},{"vendor":"f5","product":"nginx_open_source"},{"vendor":"f5","product":"nginx_plus"}],"references":[{"url":"https://my.f5.com/manage/s/article/K000152786","tags":["vendor-advisory","Vendor Advisory","advisory","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/08/13/5","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53859","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2qmj-q2xc-85v8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-53859","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-53859","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1785509707.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28753","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40701","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42946","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48142","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1785922957.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60005","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-53859","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0245.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34585","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/08/13/5","tags":["web","report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2086","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2087","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2088","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2089","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2090","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2136","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8346","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-53859","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27654","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27784","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28755","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28753","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27651","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32647","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1642","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8346.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2388238","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-53859","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436738","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1642","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000159824","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2450791","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27651","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27651","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000160383","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2450776","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27654","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27654","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000160382","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2450785","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27784","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000160364","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2450780","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28753","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000160367","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2450779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28755","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28755","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000160368","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449598","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32647","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32647","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000160366","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503089-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236851","tags":["report"]},{"url":"https://bugzilla.suse.com/1248070","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53859","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503243-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503444-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-53859","tags":["report"]},{"url":"https://nginx.org/download/patch.2025.smtp.txt","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7715-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8375-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-1642","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-9256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-27651","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-27654","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-27784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-28753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-32647","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-42934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-42945","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-42946","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-53859","title":"NGINX ngx_mail_smtp_module vulnerability","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2025-08-13T14:46:55.471Z","modified":"2025-11-04T21:12:39.856Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:32:49.180768Z"}],"euvd":[{"id":"EUVD-2025-24579","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2025-08-13T14:46:55Z","modified":"2025-11-04T21:12:39Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:49:21.143143Z"}],"ghsa":[{"id":"GHSA-2qmj-q2xc-85v8","title":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might...","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2025-08-13T15:30:35Z","modified":"2025-11-05T00:31:25Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:04:39.50413Z"}],"nvd":[{"id":"CVE-2025-53859","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2025-08-13T15:15:37.657Z","modified":"2026-06-17T09:39:02.413Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:11:23.594522Z"}],"osv":[{"id":"ALPINE-CVE-2025-53859","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2025-08-13T15:15:37.657Z","modified":"2026-08-27T22:18:02.990786008Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2025-53859","status":"published","published":"2025-08-14T06:03:34.123163Z","modified":"2026-02-11T07:47:47.82301Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-53859","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2025-08-13T15:15:37.657Z","modified":"2026-10-24T10:30:31.780384279Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:44:50.45326Z"},{"id":"DEBIAN-CVE-2025-53859","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.     Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2025-08-13T15:15:37.657Z","modified":"2026-09-01T20:05:53.868844782Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"OESA-2025-2086","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nNGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \u0026quot;none,\u0026quot; and (3) the authentication server returns the \u0026quot;Auth-Wait\u0026quot; response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2025-53859)","status":"published","published":"2025-08-29T11:09:10Z","modified":"2026-08-18T01:18:08.434242295Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2087","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nNGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \u0026quot;none,\u0026quot; and (3) the authentication server returns the \u0026quot;Auth-Wait\u0026quot; response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2025-53859)","status":"published","published":"2025-08-29T11:09:10Z","modified":"2026-08-18T01:18:08.330998174Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2088","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nNGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \u0026quot;none,\u0026quot; and (3) the authentication server returns the \u0026quot;Auth-Wait\u0026quot; response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2025-53859)","status":"published","published":"2025-08-29T11:09:10Z","modified":"2026-08-18T01:18:08.401998655Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2089","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nNGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \u0026quot;none,\u0026quot; and (3) the authentication server returns the \u0026quot;Auth-Wait\u0026quot; response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2025-53859)","status":"published","published":"2025-08-29T11:09:10Z","modified":"2026-08-18T01:18:08.311372069Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2090","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nNGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \u0026quot;none,\u0026quot; and (3) the authentication server returns the \u0026quot;Auth-Wait\u0026quot; response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2025-53859)","status":"published","published":"2025-08-29T11:09:10Z","modified":"2026-08-18T01:18:08.422893232Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2136","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nNGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \u0026apos;none,\u0026apos; and (3) the authentication server returns the \u0026apos;Auth-Wait\u0026apos; response header.(CVE-2025-53859)","status":"published","published":"2025-09-05T11:09:13Z","modified":"2026-08-18T01:18:40.189934488Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"RHSA-2026:8346","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:55Z","modified":"2026-10-10T10:23:06Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2025-53859","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2025-08-15T00:00:00Z","modified":"2026-06-03T17:59:15.393264949Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"AZL-66308","title":"CVE-2025-53859 affecting package nginx for versions less than 1.22.1-14","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2025-08-13T15:15:37Z","modified":"2026-04-21T04:37:50.460335Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"AZL-66311","title":"CVE-2025-53859 affecting package nginx for versions less than 1.25.4-5","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2025-08-13T15:15:37Z","modified":"2026-04-21T04:55:24.104684Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"BIT-nginx-2025-53859","title":"NGINX ngx_mail_smtp_module vulnerability","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2025-08-18T08:07:31.835Z","modified":"2026-09-08T08:48:16.878329247Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-nginx-gateway-2025-53859","title":"NGINX ngx_mail_smtp_module vulnerability","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2025-12-03T11:44:32.49Z","modified":"2026-09-08T08:48:16.811767327Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CLSA-2026-1785509707","title":"nginx: Fix of 6 CVEs","description":"- CVE-2025-53859: fix buffer over-read in the SMTP authentication path that\n  could disclose worker process memory to the authentication server\n- CVE-2026-28753: validate host names resolved from the client address to\n  prevent header injection into auth_http and XCLIENT requests\n- CVE-2026-40701: fix use-after-free by cancelling a pending OCSP responder\n  resolve when the client connection is closed\n- CVE-2026-42934: fix buffer over-read in the charset filter when a UTF-8\n  sequence is split across several buffers\n- CVE-2026-48142: fix remaining buffer over-read in the charset filter on\n  invalid UTF-8 sequences\n- CVE-2026-42946: reset the parsing state and restore the buffer position\n  after an unrecognized upstream status line in the scgi and uwsgi modules","status":"published","published":"2026-07-31T15:01:40Z","modified":"2026-10-26T09:43:18.215783126Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785922957","title":"nginx: Fix of 5 CVEs","description":"- CVE-2026-40701: fix resolver use-after-free in OCSP; the resolve\n  context was leaked when a client SSL connection was terminated while\n  resolving an OCSP responder, so completion of the resolve touched\n  freed memory\n- CVE-2025-53859: fix buffer over-read in ngx_mail_smtp_module; login\n  and password storage could be left in an inconsistent state after\n  base64 decoding errors in the plain/login/cram-md5 auth methods\n- CVE-2026-28753: validate the host name resolved from the client\n  address against the character set of RFC 1034 section 3.5,\n  preventing CRLF injection into auth_http and smtp proxy requests\n- CVE-2026-42934: fix buffer over-read in ngx_http_charset_module\n  recode_from_utf8(); pass the saved byte count rather than the last\n  saved index to ngx_utf8_decode() and advance past the whole saved\n  sequence on invalid UTF-8","status":"published","published":"2026-08-26T15:39:23Z","modified":"2026-10-26T09:43:34.844504309Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"MGASA-2025-0245","title":"Updated nginx package fixes security vulnerability","description":"It was discovered that nginx contains a security issue in the\nngx_mail_smtp_module which might allow an attacker to cause buffer\nover-read potentially resulting in sensitive information leak in a HTTP\nrequest to the authentication server (CVE-2025-53859).\n","status":"published","published":"2025-10-22T20:07:31Z","modified":"2026-04-16T04:41:25.952839316Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15449-1","title":"nginx-1.29.1-1.1 on GA media","description":"These are all security issues fixed in the nginx-1.29.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-15T00:00:00Z","modified":"2026-03-23T04:53:47.704473Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:03089-1","title":"Security update for nginx","description":"This update for nginx fixes the following issues:\n\n- CVE-2025-53859: the server side may leak arbitrary bytes during the NGINX SMTP authentication process (bsc#1248070).\n- CVE-2025-23419: session resumption can bypass client certificate authentication requirements using TLSv1.3\n  (bsc#1236851).\n","status":"published","published":"2025-09-05T10:38:57Z","modified":"2026-03-23T04:49:53.902563Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03243-1","title":"Security update for nginx","description":"This update for nginx fixes the following issues:\n\n- CVE-2025-53859: the server side may leak arbitrary bytes during the NGINX SMTP authentication process (bsc#1248070).\n- CVE-2025-23419: session resumption can bypass client certificate authentication requirements using TLSv1.3\n  (bsc#1236851).\n","status":"published","published":"2025-09-17T10:24:10Z","modified":"2026-02-04T03:45:18.069413Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03444-1","title":"Security update for nginx","description":"This update for nginx fixes the following issues:\n\n- CVE-2025-53859:�the server side may leak arbitrary bytes during the NGINX SMTP authentication process (bsc#1248070).\n- CVE-2025-23419: session resumption can bypass client certificate authentication requirements using TLSv1.3 (bsc#1236851).\n","status":"published","published":"2025-10-01T12:42:59Z","modified":"2026-05-19T06:28:55.303483872Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"USN-7715-1","title":"nginx vulnerability","description":"It was discovered that the nginx ngx_mail_smtp_module module incorrectly\nhandled certain memory operations when doing SMTP authentication. This\ncould possibly result in sensitive information being sent to the\nauthentication server.","status":"published","published":"2025-08-25T12:14:35Z","modified":"2026-04-27T18:15:27.052352Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-8375-1","title":"nginx vulnerabilities","description":"It was discovered that the nginx ngx_mail_smtp_module module incorrectly\nhandled certain memory operations when doing SMTP authentication. This\ncould possibly result in sensitive information being sent to the\nauthentication server. (CVE-2025-53859)\n\nIt was discovered that nginx incorrectly handled proxying to upstream TLS\nservers. An attacker could possibly use this issue to insert plain text\ndata into the response from an upstream proxied server. (CVE-2026-1642)\n\nIt was discovered that the nginx ngx_mail_auth_http_module module\nincorrectly handled certain requests. An attacker could possibly use this\nissue to cause nginx to crash, resulting in a denial of service.\n(CVE-2026-27651)\n\nIt was discovered that the nginx ngx_http_dav_module module incorrectly\nhandled certain destination URIs. An attacker could use this issue to cause\nnginx to crash, resulting in a denial of service, or possibly modify source\nor destination names outside of the document root. (CVE-2026-27654)\n\nIt was discovered that the nginx ngx_http_mp4_module module incorrectly\nhandled certain MP4 files. An attacker could use this issue to cause nginx\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2026-27784, CVE-2026-32647)\n\nIt was discovered that the nginx ngx_mail_smtp_module module incorrectly\nhandled certain CRLF sequences. An attacker could possibly use this issue\nto inject arbitrary SMTP headers. (CVE-2026-28753)\n\nIt was discovered that nginx contained a use-after-free vulnerability in\nthe ngx_http_ssl_module module when client certificate verification and\nOCSP validation were enabled. A remote attacker could use this issue to\ncause nginx to crash, resulting in a denial of service, or possibly modify\ndata in memory. (CVE-2026-40701)\n\nIt was discovered that nginx did not properly handle certain proxied\nresponses in the ngx_http_charset_module module. A remote attacker could\npossibly use this issue to obtain sensitive information or cause nginx to\ncrash, resulting in a denial of service. (CVE-2026-42934)\n\nIt was discovered that the nginx ngx_http_rewrite_module component\nincorrectly handled certain rewrite directives. A remote attacker could use\nthis issue to cause nginx to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2026-42945)\n\nIt was discovered that nginx did not properly process certain SCGI and\nuWSGI responses. An attacker able to perform a machine-in-the-middle attack\ncould possibly use this issue to obtain sensitive information or cause\nnginx to crash, resulting in a denial of service. (CVE-2026-42946)\n\nIt was discovered that nginx incorrectly handled certain rewrite rules in\nthe ngx_http_rewrite_module module. A remote attacker could use this issue\nto cause nginx to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2026-9256)","status":"published","published":"2026-06-03T07:11:56Z","modified":"2026-06-30T18:17:07.148587773Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}