When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-streamUpgrade nginx-mod-develUpgrade nginx-mod-http-xslt-filterUpgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nginxUpgrade nginx-mod-http-image-filterUpgrade nginx-coreUpgrade nginx-mod-http-perlUpgrade nginx-all-modules | Apr 13, 2026 | Apr 7, 2026 |
| Alpine Linux | — | Upgrade nginx | Mar 27, 2026 | Mar 24, 2026 |
| Amazon Linux Ami 2 | — | Upgrade nginx-mod-mailUpgrade nginxUpgrade nginx-filesystemUpgrade nginx-mod-http-geoipUpgrade nginx-all-modulesUpgrade nginx-mod-streamUpgrade nginx-coreUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-develUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filter | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade nginx-mod-http-image-filterUpgrade nginx-coreUpgrade nginx-debugsourceUpgrade nginx-filesystemUpgrade nginx-core-debuginfoUpgrade nginx-mod-http-perlUpgrade nginx-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginxUpgrade nginx-mod-develUpgrade nginx-all-modulesUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-mail | Apr 14, 2026 | Mar 24, 2026 |
| Debian | — | Upgrade nginx | May 17, 2026 | May 17, 2026 |
| Gentoo Linux | — | Upgrade www-servers/nginx. | Aug 17, 2026 | Aug 17, 2026 |
| Nginx | — | Upgrade to nginx version 1.28.3Upgrade to nginx version 1.29.7 | Mar 27, 2026 | Mar 24, 2026 |
| Oracle_linux | — | Upgrade nginx-mod-develUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filterUpgrade nginx-filesystemUpgrade nginx-coreUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginx-all-modulesUpgrade nginx | Apr 22, 2026 | Mar 24, 2026 |
| Redhat_linux | — | Upgrade nginx-mod-http-image-filterUpgrade nginx-core-debuginfoUpgrade nginxUpgrade nginx-mod-mailUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-coreUpgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade nginx-all-modulesUpgrade nginx-mod-stream-debuginfoUpgrade nginx-filesystemUpgrade nginx-mod-mail-debuginfoUpgrade nginx-debugsourceUpgrade nginx-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-develUpgrade nginx-mod-http-image-filter-debuginfo | Apr 9, 2026 | Mar 24, 2026 |
| Rocky_linux | — | Upgrade nginx-mod-http-perlUpgrade nginxUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-mailUpgrade nginx-coreUpgrade nginx-core-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-mail-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-develUpgrade nginx-mod-http-image-filter-debuginfo | Apr 10, 2026 | Apr 8, 2026 |
| Ubuntu | — | Upgrade nginx-coreUpgrade libnginx-mod-http-auth-pam (Ubuntu Pro)Upgrade libnginx-mod-http-uploadprogress (Ubuntu Pro)Upgrade nginx-light (Ubuntu Pro)Upgrade libnginx-mod-http-lua (Ubuntu Pro)Upgrade libnginx-mod-http-geoip (Ubuntu Pro)Upgrade nginx-extrasUpgrade nginx (Ubuntu Pro)Upgrade libnginx-mod-http-cache-purge (Ubuntu Pro)Upgrade libnginx-mod-http-xslt-filter (Ubuntu Pro)Upgrade nginx-full (Ubuntu Pro)Upgrade libnginx-mod-http-headers-more-filter (Ubuntu Pro)Upgrade nginxUpgrade nginx-fullUpgrade libnginx-mod-stream (Ubuntu Pro)Upgrade libnginx-mod-http-subs-filter (Ubuntu Pro)Upgrade nginx-core (Ubuntu Pro)Upgrade libnginx-mod-http-dav-ext (Ubuntu Pro)Upgrade libnginx-mod-http-upstream-fair (Ubuntu Pro)Upgrade libnginx-mod-rtmp (Ubuntu Pro)Upgrade libnginx-mod-mail (Ubuntu Pro)Upgrade libnginx-mod-nchan (Ubuntu Pro)Upgrade libnginx-mod-http-fancyindex (Ubuntu Pro)Upgrade nginx-extras (Ubuntu Pro)Upgrade libnginx-mod-http-image-filter (Ubuntu Pro)Upgrade libnginx-mod-http-perl (Ubuntu Pro)Upgrade libnginx-mod-http-ndk (Ubuntu Pro)Upgrade nginx-lightUpgrade nginx-common (Ubuntu Pro)Upgrade libnginx-mod-http-echo (Ubuntu Pro)Upgrade nginx-naxsi (Ubuntu Pro) | Apr 28, 2026 | Apr 27, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 24, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub