CVE-2025-53859

🗓️ 13 Aug 2025 14:46:55Reported by Debian Security Bug TrackerType

NGINX SMTP over-read in ngx_mail_smtp_module leaks mem during auth; unauth attacker; smtp_auth none.

Reporter	Title	Published	Views	Family All 100
Tenable Nessus	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2025-1152)	18 Aug 202500:00	–	nessus
Tenable Nessus	Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2025-009 (ALASNGINX1-2025-009)	19 Aug 202500:00	–	nessus
Tenable Nessus	Debian dla-4589 : libnginx-mod-http-auth-pam - security update	18 May 202600:00	–	nessus
Tenable Nessus	Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2025-530e10091c)	26 Dec 202500:00	–	nessus
Tenable Nessus	Fedora 43 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2025-8aa169ea14)	2 Jan 202600:00	–	nessus
Tenable Nessus	Fedora 42 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2025-8caa129b2e)	3 Jan 202600:00	–	nessus
Tenable Nessus	FreeBSD : nginx -- worker process memory disclosure (eb03714d-79f0-11f0-b4c1-ac5afc632ba3)	15 Aug 202500:00	–	nessus
Tenable Nessus	nginx 0.7.22 < 1.29.1 Information Disclosure	22 Aug 202500:00	–	nessus
Tenable Nessus	Photon OS 4.0: Nginx PHSA-2025-4.0-0852	20 Aug 202500:00	–	nessus
Tenable Nessus	Photon OS 5.0: Nginx PHSA-2025-5.0-0596	20 Aug 202500:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	11	any	nginx	1.18.0-6.1+deb11u6	nginx_1.18.0-6.1+deb11u6_any.deb
Debian	12	any	nginx	1.22.1-9+deb12u3	nginx_1.22.1-9+deb12u3_any.deb
Debian	13	any	nginx	1.26.3-3+deb13u1	nginx_1.26.3-3+deb13u1_any.deb
Debian	14	any	nginx	1.28.0-3	nginx_1.28.0-3_any.deb
Debian	999	any	nginx	1.28.0-3	nginx_1.28.0-3_any.deb

13 Aug 2025 14:46Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.13.7

CVSS 46.3

EPSS0.00394

SSVC