Skip to main content

Nginx Plus CVE-2026-27651

| EUVDEUVD-2026-14880 HIGH
NULL Pointer Dereference (CWE-476)
2026-03-24 f5
Denial Of Service Null Pointer Dereference Nginx Nginx Open Source Nginx Plus F5
8.7
CVSS 4.0 · Vendor: f5
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send CRAM-MD5/APOP authentication request
  2. Exploit
    Trigger Auth-Wait response header
  3. Execution
    Cause worker process crash
  4. Impact
    Achieve denial of service

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

NGINX Plus or NGINX Open Source with ngx_mail_auth_http_module enabled AND (CRAM-MD5 or APOP authentication enabled) AND authentication server configured to return Auth-Wait response header. Remote unauthenticated attacker can send crafted mail protocol requests to trigger worker process termination. No victim interaction required.
Impact

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates this is a straightforward network-based attack requiring no authentication or user interaction, making it highly automatable. However, exploitation requires a specific configuration: the mail module must be enabled with CRAM-MD5 or APOP authentication, and the authentication server must support Auth-Wait responses—a relatively uncommon deployment scenario. While the CVSS score of 7.5 suggests high severity, real-world impact is constrained by these prerequisites. The absence of EPSS and KEV data at this time, combined with no publicly disclosed proof-of-concept, suggests limited active exploitation. For organizations running NGINX as a mail proxy with the specific authentication configuration, this represents a genuine denial-of-service risk requiring prompt attention. For typical HTTP/HTTPS reverse proxy deployments (the most common NGINX use case), this vulnerability is not applicable, significantly reducing the actual attack surface.
Exploit ScenarioDerived

An unauthenticated remote attacker identifies an NGINX server operating as a mail proxy with CRAM-MD5 or APOP authentication enabled. The attacker sends specially crafted authentication requests designed to trigger the Auth-Wait response path from the backend authentication server. When the NGINX worker process attempts to handle the retry logic with the malicious request structure, it dereferences a null pointer and crashes, causing legitimate mail clients to lose connectivity until the worker process restarts, enabling repeated denial-of-service attacks.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 24, 2026

NGINX worker process crashes via null pointer dereference in the mail authentication module when CRAM-MD5 or APOP authentication is configured with retry-enabled backend servers. This denial of service vulnerability affects NGINX Plus and NGINX Open Source with no patch currently available, allowing unauthenticated remote attackers to terminate worker processes and degrade service availability.

Earlier versions of this analysis (1)
v1 Mar 24, 2026 - 14:45 CVSS 8.7

A null pointer dereference vulnerability in NGINX Open Source and NGINX Plus allows remote unauthenticated attackers to crash worker processes, causing denial of service. The vulnerability is triggered through undisclosed requests when the ngx_mail_auth_http_module is enabled with CRAM-MD5 or APOP authentication and the authentication server returns Auth-Wait response headers. With a CVSS score of 7.5 (High severity) and network-accessible attack vector requiring no privileges or user interaction, this poses a significant availability risk to affected mail proxy deployments.

RemediationAI

Consult the F5 security advisory at https://my.f5.com/manage/s/article/K000160383 for specific patch versions and upgrade instructions for both NGINX Open Source and NGINX Plus. Organizations should prioritize upgrading to patched versions provided by F5 that address the null pointer dereference in the mail authentication module. As an immediate mitigation for environments that cannot patch immediately, administrators should consider disabling CRAM-MD5 and APOP authentication methods in favor of alternative authentication mechanisms, or disable the Auth-Wait retry functionality on the authentication backend if business requirements permit. For deployments where the mail proxy functionality is not required, disabling the ngx_mail_auth_http_module entirely eliminates exposure. Network-level controls such as restricting access to mail proxy ports to trusted IP ranges can reduce attack surface but do not eliminate the vulnerability for legitimate users.

Affected VersionsENISA

NGINX Open Source 1.29.0 <1.29.7
NGINX Plus R33 <*
NGINX Plus R36 <R36 P3
NGINX Plus R34 <*
NGINX Open Source 0.5.15 <1.28.3
NGINX Plus R35 <R35 P2
NGINX Plus R32 <R32 P5

Affected Packages

euvd nginx_open_source fix: 1.28.3, 1.29.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability affects the ngx_mail_auth_http_module in NGINX, which provides HTTP-based authentication for mail proxy functionality. The affected products are NGINX Open Source (cpe:2.3:a:f5:nginx_open_source) and NGINX Plus (cpe:2.3:a:f5:nginx_plus). The root cause is CWE-476 (NULL Pointer Dereference), which occurs when specially crafted requests are processed during CRAM-MD5 or APOP authentication flows when the authentication backend returns an Auth-Wait header instructing the proxy to retry authentication. This architectural flaw in pointer handling during the authentication retry mechanism allows the worker process to access invalid memory locations, leading to process termination.

Know when Nginx Plus gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (f5) PRIMARY 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch released
Apr 10, 2026 - 08:30 nvd
Patch available
CVE Published
Mar 24, 2026 - 14:13 nvd
HIGH 8.7

DescriptionCVE.org

When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Executive ViewAI

Why It Matters

A high-severity vulnerability in NGINX mail proxy modules can be exploited remotely to crash worker processes, causing denial of service for mail authentication services. Organizations running NGINX with mail authentication features are at immediate risk of service interruption, with no vendor patch currently available to fully remediate the issue.

Business Impact: High
Compensating Controls

Disable ngx_mail_auth_http_module if mail proxy functionality is not essential; implement network-based access controls to restrict mail proxy connectivity to trusted authentication servers only; deploy WAF rules to detect and block malformed authentication requests; configure process monitoring and auto-restart mechanisms for NGINX worker processes; consider deploying a reverse proxy or load balancer in front of NGINX to absorb and filter potentially malicious requests.

Threat Intelligence Overview

EPSS Score
0.0%
Top 91% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Related Vulnerabilities in NGINX Multiple Module Vulnerabilities

View all 6
CVE-2026-28753 MEDIUM
6.3
CVE-2026-28755 MEDIUM
5.3
CVE-2026-27784 HIGH
8.5
CVE-2026-32647 HIGH
8.5
CVE-2026-27654 HIGH POC
8.8

More in Nginx Plus

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2026-42945 CRITICAL POC
9.2 May 13

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker
CVE-2026-42055 CRITICAL POC
9.2 Jun 17

Heap-based buffer overflow in NGINX Plus and NGINX Open Source affects deployments that proxy HTTP/2 or gRPC traffic ups
CVE-2026-9256 CRITICAL POC
9.2 May 22

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module can be triggered by unauthenticated rem
CVE-2026-42533 CRITICAL POC
9.2 Jul 15

Heap buffer overflow in NGINX Plus and NGINX Open Source lets unauthenticated remote attackers crash worker processes (D
CVE-2026-93479 CRITICAL POC
9.2 Oct 14

Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by crafted HTTP requests when a non-default ma
CVE-2026-15176 CRITICAL POC
9.2 Oct 14

Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by unauthenticated remote attackers through cr
CVE-2026-97205 CRITICAL POC
9.2 Oct 14

Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O
CVE-2026-60005 HIGH
8.8 Jul 15

Limited memory disclosure and worker-process restart in NGINX Plus and NGINX Open Source arise when the optional ngx_htt
CVE-2024-39792 HIGH
8.7 Aug 14

When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 8 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:6906 ADVISORY https://access.redhat.com/errata/RHSA-2026:6907 ADVISORY https://access.redhat.com/errata/RHSA-2026:6923 ADVISORY https://access.redhat.com/errata/RHSA-2026:7002 ADVISORY https://access.redhat.com/errata/RHSA-2026:7343 ADVISORY https://my.f5.com/manage/s/article/K000160383 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-27651 ADVISORY https://ubuntu.com/security/notices/USN-8375-1 ADVISORY https://vuldb.com/?id.352781 REF https://access.redhat.com/errata/RHSA-2026:10065 REF https://access.redhat.com/errata/RHSA-2026:13634 REF https://access.redhat.com/errata/RHSA-2026:13680 REF https://access.redhat.com/errata/RHSA-2026:13839 REF https://access.redhat.com/errata/RHSA-2026:14836 REF https://access.redhat.com/errata/RHSA-2026:15942 REF https://access.redhat.com/errata/RHSA-2026:15943 REF https://access.redhat.com/errata/RHSA-2026:15945 REF https://access.redhat.com/errata/RHSA-2026:15966 REF https://access.redhat.com/errata/RHSA-2026:8346 REF https://access.redhat.com/security/cve/CVE-2026-27651 REF https://bugzilla.redhat.com/show_bug.cgi?id=2450791 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27651.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy