Is CVE-2026-27651 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27651 being exploited in the wild.

How severe is CVE-2026-27651?

High severity, with a CVSS score of 7.5, published 24 March 2026.

Which products and versions are affected?

NGINX NGINX Open Source; F5 NGINX Plus; Red Hat Enterprise Linux 8, 9, 10.0, 10.1.

Is there a fix for CVE-2026-27651?

A patch was published on 2026-04-23: Red Hat released security updates (RHSA-2026:10065) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27651 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-27651?

Check whether you run F5 Nginx Plus or NGINX Open Source. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27651: NGINX NULL pointer dereference in ngx_mail_auth_http_module

CVE-2026-27651 · Severity: high · CVSS 7.5 · Published 2026-03-24

NGINX is a widely used web and proxy server that also handles email traffic. A vulnerability in its mail authentication module allows a remote attacker to crash the server's worker processes by sending specific requests. This results in a denial of service, preventing the server from processing legitimate traffic and potentially disrupting email services.

Technologies: F5 Nginx Plus, NGINX Open Source. Vendors: F5, NGINX.

Quick answers

Is CVE-2026-27651 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27651 being exploited in the wild.
How severe is CVE-2026-27651?: High severity, with a CVSS score of 7.5, published 24 March 2026.
Which products and versions are affected?: NGINX NGINX Open Source; F5 NGINX Plus; Red Hat Enterprise Linux 8, 9, 10.0, 10.1.
Is there a fix for CVE-2026-27651?: A patch was published on 2026-04-23: Red Hat released security updates (RHSA-2026:10065) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27651 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-27651?: Check whether you run F5 Nginx Plus or NGINX Open Source. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference vulnerability (CWE-476) exists in the ngx_mail_auth_http_module of NGINX. The issue is triggered when CRAM-MD5 or APOP authentication is enabled and the upstream authentication server returns an 'Auth-Wait' response header to permit a retry. An attacker can send undisclosed requests that cause NGINX worker processes to terminate, leading to a denial of service. The vulnerability is reachable over the network without authentication. Patches have been released by NGINX and various Linux distributions including Red Hat.

Affected products

NGINX NGINX Open Source
F5 NGINX Plus
Red Hat Enterprise Linux 8, 9, 10.0, 10.1

Timeline

2026-03-24: disclosed
2026-03-24: advisory: Initial NVD publication
2026-04-23: patched: Red Hat released security updates (RHSA-2026:10065)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.