Junglewise Threat Intelligence

CVE-2026-27651: NGINX NULL pointer dereference in ngx_mail_auth_http_module

CVE-2026-27651 · Severity: high · CVSS 7.5 · Published 2026-03-24

Technologies: F5 Nginx Plus, Red Hat Enterprise Linux, NGINX Open Source. Vendors: F5, Red Hat, NGINX.

Executive brief

NGINX is a widely used web and proxy server that also handles email traffic. A vulnerability in its mail authentication module allows a remote attacker to crash the server's worker processes by sending specific requests. This results in a denial of service, preventing the server from processing legitimate traffic and potentially disrupting email services.

Technical details

A NULL pointer dereference vulnerability (CWE-476) exists in the ngx_mail_auth_http_module of NGINX. The issue is triggered when CRAM-MD5 or APOP authentication is enabled and the upstream authentication server returns an 'Auth-Wait' response header to permit a retry. An attacker can send undisclosed requests that cause NGINX worker processes to terminate, leading to a denial of service. The vulnerability is reachable over the network without authentication. Patches have been released by NGINX and various Linux distributions including Red Hat.

Affected products

  • NGINX NGINX Open Source
  • F5 NGINX Plus
  • Red Hat Enterprise Linux 8, 9, 10.0, 10.1

Timeline

  • 2026-03-24: disclosed
  • 2026-03-24: advisory: Initial NVD publication
  • 2026-04-23: patched: Red Hat released security updates (RHSA-2026:10065)

References

Related threats