CVE-2026-27651

HighCVSS 7.5/10Last modified Jul 15, 2026

Description

When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
F5NGINX Open Source>= 1.29.0, < 1.29.7; >= 0.5.15, < 1.28.3
F5NGINX Plus>= R36, < R36 P3; >= R35, < R35 P2; >= R34, < *; >= R33, < *; >= R32, < R32 P5
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Hardened Images—
Red HatRed Hat Update Infrastructure 5—
Red HatRed Hat Update Infrastructure 5—

References

Timeline

Published
Mar 24, 2026
Last modified
Jul 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-276527.5The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the CVE-2026-276536.7The installers for multiple products provided by Soliton Systems K.K. contain an issue with incorrect default permissions, which may allow aCVE-2026-276548.2NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer oveCVE-2026-276554.8Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.CVE-2026-276566.1Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in theCVE-2026-276577.5Gitea versions before 1.25.5 allow a user to change another user's primary email address.CVE-2026-276594.6Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /CVE-2026-27669.8Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, andCVE-2026-276607.5Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.CVE-2026-276614.3A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application leaks confidential informatiCVE-2026-276627.7Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in pCVE-2026-276636.5A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), RTUM85 RTU Base (All versions < V26.
CVE-2026-27651: High severity, CVSS 7.5 | Vulnix