Out-of-bounds Read in F5 nginx Open Source
CVE-2025-53859
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method "none," and (3) the authentication server returns the "Auth-Wait" response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability class: Buffer Overflow
EPSS: 0.004 (32.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- F5 Nginx Open Source — versions 0.7
- F5 Nginx_open_source
- F5 Nginx Plus — versions R35, R34, R33
- F5 Nginx_plus — versions r30, r31, r32
Weakness classification (CWE)
Public proof-of-concept exploits
References
- f5sirt@f5.com (vendor-advisory, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-53859?
- CVE-2025-53859 is a low-severity vulnerability in F5 nginx Open Source, classified under Out-of-bounds Read. CVSS score: 3.7/10. Published 2025-08-13.
- How severe is CVE-2025-53859?
- Low severity. CVSS v3 base score is 3.7 out of 10.
- Is CVE-2025-53859 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.