https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T02:35:14.527287+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2025-53859 CVE-2025-53859 — NGINX ngx_mail_smtp_module vulnerability 2026-09-29T02:35:14.535044+00:00

Affected: F5 NGINX Plus, F5 NGINX Open Source

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method "none," and (3) the authentication server returns the "Auth-Wait" response header.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

 https://vulnerability.circl.lu/vuln/usn-7715-1 USN-7715-1 — nginx vulnerability 2026-09-29T02:35:14.535133+00:00

Affected: Ubuntu:22.04:LTS: nginx, Ubuntu:24.04:LTS: nginx

It was discovered that the nginx ngx_mail_smtp_module module incorrectly handled certain memory operations when doing SMTP authentication. This could possibly result in sensitive information being sent to the authentication server.