Nginx Plus CVE-2026-28753

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates network-adjacent attack vector, high attack complexity, no privilege requirement, and integrity impact only. The high attack complexity is the limiting factor; an attacker must control or intercept DNS traffic, which is not trivial in most modern networks using DNSSEC or trusted DNS resolvers. The integrity impact is limited to SMTP header injection rather than full request hijacking. Without confirmed EPSS data or KEV listing details provided, the real-world exploitability remains moderate; this is not a remote code execution or authentication bypass vector. Organizations with isolated SMTP infrastructure, local DNS servers, or DNSSEC validation enabled face significantly lower risk. The vulnerability should be prioritized below critical patches but addressed in routine maintenance cycles, particularly in edge environments where DNS security posture is weak.

An attacker who controls or has compromised an organizational DNS server or performs ARP spoofing on a local network segment can intercept DNS queries from an NGINX mail proxy asking for SMTP upstream server resolution. The attacker responds with a malicious DNS answer containing CRLF sequences that inject arbitrary SMTP commands or headers when parsed by NGINX. For example, crafted DNS response data could inject Received or X-Custom headers, or attempt to manipulate the recipient list, allowing mail routing manipulation or header spoofing. This attack requires the attacker to have network access to intercept DNS traffic (high attack complexity), making it most practical in shared hosting environments or compromised internal networks rather than across the public internet.