UBUNTU-CVE-2025-53859
- Source
- https://ubuntu.com/security/CVE-2025-53859
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-53859.json
- JSON Data
- https://api.osv.dev/v1/vulns/UBUNTU-CVE-2025-53859
- Upstream
- Downstream
- Related
- Published
- 2025-08-15T00:00:00Z
- Modified
- 2026-06-03T17:59:15Z
- Severity
-
- 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Ubuntu - medium
- Summary
- [none]
- Details
-
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method "none," and (3) the authentication server returns the "Auth-Wait" response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- References
-
- https://ubuntu.com/security/CVE-2025-53859
- https://www.cve.org/CVERecord?id=CVE-2025-53859
- https://www.openwall.com/lists/oss-security/2025/08/13/5
- https://nginx.org/download/patch.2025.smtp.txt
- https://my.f5.com/manage/s/article/K000152786
- https://ubuntu.com/security/notices/USN-7715-1
- https://ubuntu.com/security/notices/USN-8375-1
Affected packages
Ubuntu:22.04:LTS
nginx
Package
- Name
- nginx
- Purl
- pkg:deb/ubuntu/nginx?arch=source&distro=jammy
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.18.0-6ubuntu14.7
Affected versions
1.*
1.18.0-6ubuntu11
1.18.0-6ubuntu12
1.18.0-6ubuntu14
1.18.0-6ubuntu14.1
1.18.0-6ubuntu14.2
1.18.0-6ubuntu14.3
1.18.0-6ubuntu14.4
1.18.0-6ubuntu14.5
1.18.0-6ubuntu14.6
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_name": "libnginx-mod-http-auth-pam",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-http-cache-purge",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-http-dav-ext",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-http-echo",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-http-fancyindex",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-http-geoip",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-http-geoip2",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-http-headers-more-filter",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-http-image-filter",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-http-ndk",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-http-perl",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-http-subs-filter",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-http-uploadprogress",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-http-upstream-fair",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-http-xslt-filter",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-mail",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-nchan",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-rtmp",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-stream",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-stream-geoip",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "libnginx-mod-stream-geoip2",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "nginx",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "nginx-common",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "nginx-core",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "nginx-extras",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "nginx-full",
"binary_version": "1.18.0-6ubuntu14.7"
},
{
"binary_name": "nginx-light",
"binary_version": "1.18.0-6ubuntu14.7"
}
]
}Ubuntu:24.04:LTS
nginx
Package
- Name
- nginx
- Purl
- pkg:deb/ubuntu/nginx?arch=source&distro=noble
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.24.0-2ubuntu7.5
Affected versions
1.*
1.24.0-1ubuntu1
1.24.0-2ubuntu1
1.24.0-2ubuntu2
1.24.0-2ubuntu3
1.24.0-2ubuntu4
1.24.0-2ubuntu6
1.24.0-2ubuntu7
1.24.0-2ubuntu7.1
1.24.0-2ubuntu7.3
1.24.0-2ubuntu7.4
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_name": "libnginx-mod-http-geoip",
"binary_version": "1.24.0-2ubuntu7.5"
},
{
"binary_name": "libnginx-mod-http-image-filter",
"binary_version": "1.24.0-2ubuntu7.5"
},
{
"binary_name": "libnginx-mod-http-perl",
"binary_version": "1.24.0-2ubuntu7.5"
},
{
"binary_name": "libnginx-mod-http-xslt-filter",
"binary_version": "1.24.0-2ubuntu7.5"
},
{
"binary_name": "libnginx-mod-mail",
"binary_version": "1.24.0-2ubuntu7.5"
},
{
"binary_name": "libnginx-mod-stream",
"binary_version": "1.24.0-2ubuntu7.5"
},
{
"binary_name": "libnginx-mod-stream-geoip",
"binary_version": "1.24.0-2ubuntu7.5"
},
{
"binary_name": "nginx",
"binary_version": "1.24.0-2ubuntu7.5"
},
{
"binary_name": "nginx-common",
"binary_version": "1.24.0-2ubuntu7.5"
},
{
"binary_name": "nginx-core",
"binary_version": "1.24.0-2ubuntu7.5"
},
{
"binary_name": "nginx-extras",
"binary_version": "1.24.0-2ubuntu7.5"
},
{
"binary_name": "nginx-full",
"binary_version": "1.24.0-2ubuntu7.5"
},
{
"binary_name": "nginx-light",
"binary_version": "1.24.0-2ubuntu7.5"
}
]
}Ubuntu:25.10
nginx
Package
- Name
- nginx
- Purl
- pkg:deb/ubuntu/nginx?arch=source&distro=questing
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.26.3-3ubuntu3
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_name": "libnginx-mod-http-geoip",
"binary_version": "1.26.3-3ubuntu3"
},
{
"binary_name": "libnginx-mod-http-image-filter",
"binary_version": "1.26.3-3ubuntu3"
},
{
"binary_name": "libnginx-mod-http-perl",
"binary_version": "1.26.3-3ubuntu3"
},
{
"binary_name": "libnginx-mod-http-xslt-filter",
"binary_version": "1.26.3-3ubuntu3"
},
{
"binary_name": "libnginx-mod-mail",
"binary_version": "1.26.3-3ubuntu3"
},
{
"binary_name": "libnginx-mod-stream",
"binary_version": "1.26.3-3ubuntu3"
},
{
"binary_name": "libnginx-mod-stream-geoip",
"binary_version": "1.26.3-3ubuntu3"
},
{
"binary_name": "nginx",
"binary_version": "1.26.3-3ubuntu3"
},
{
"binary_name": "nginx-common",
"binary_version": "1.26.3-3ubuntu3"
},
{
"binary_name": "nginx-core",
"binary_version": "1.26.3-3ubuntu3"
},
{
"binary_name": "nginx-extras",
"binary_version": "1.26.3-3ubuntu3"
},
{
"binary_name": "nginx-full",
"binary_version": "1.26.3-3ubuntu3"
},
{
"binary_name": "nginx-light",
"binary_version": "1.26.3-3ubuntu3"
}
]
}Ubuntu:Pro:14.04:LTS
nginx
Package
- Name
- nginx
- Purl
- pkg:deb/ubuntu/nginx?arch=source&distro=esm-infra-legacy%2Ftrusty
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.4.6-1ubuntu3.9+esm6
Affected versions
1.*
1.4.1-3ubuntu1
1.4.3-2ubuntu1
1.4.4-1ubuntu1
1.4.4-2ubuntu1
1.4.4-4ubuntu1
1.4.5-1ubuntu1
1.4.6-1ubuntu2
1.4.6-1ubuntu3
1.4.6-1ubuntu3.1
1.4.6-1ubuntu3.2
1.4.6-1ubuntu3.3
1.4.6-1ubuntu3.4
1.4.6-1ubuntu3.5
1.4.6-1ubuntu3.6
1.4.6-1ubuntu3.7
1.4.6-1ubuntu3.8
1.4.6-1ubuntu3.9
1.4.6-1ubuntu3.9+esm1
1.4.6-1ubuntu3.9+esm2
1.4.6-1ubuntu3.9+esm3
1.4.6-1ubuntu3.9+esm4
1.4.6-1ubuntu3.9+esm5
Ecosystem specific
{
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "nginx",
"binary_version": "1.4.6-1ubuntu3.9+esm6"
},
{
"binary_name": "nginx-common",
"binary_version": "1.4.6-1ubuntu3.9+esm6"
},
{
"binary_name": "nginx-core",
"binary_version": "1.4.6-1ubuntu3.9+esm6"
},
{
"binary_name": "nginx-extras",
"binary_version": "1.4.6-1ubuntu3.9+esm6"
},
{
"binary_name": "nginx-full",
"binary_version": "1.4.6-1ubuntu3.9+esm6"
},
{
"binary_name": "nginx-light",
"binary_version": "1.4.6-1ubuntu3.9+esm6"
},
{
"binary_name": "nginx-naxsi",
"binary_version": "1.4.6-1ubuntu3.9+esm6"
},
{
"binary_name": "nginx-naxsi-ui",
"binary_version": "1.4.6-1ubuntu3.9+esm6"
}
]
}Ubuntu:Pro:16.04:LTS
nginx
Package
- Name
- nginx
- Purl
- pkg:deb/ubuntu/nginx?arch=source&distro=esm-infra-legacy%2Fxenial
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.10.3-0ubuntu0.16.04.5+esm7
Affected versions
1.*
1.9.3-1ubuntu1
1.9.6-2ubuntu1
1.9.6-2ubuntu2
1.9.9-0ubuntu1
1.9.9-1ubuntu1
1.9.10-0ubuntu1
1.9.10-1ubuntu1
1.9.11-0ubuntu1
1.9.11-0ubuntu2
1.9.12-0ubuntu1
1.9.13-0ubuntu1
1.9.14-0ubuntu1
1.9.15-0ubuntu1
1.10.0-0ubuntu0.16.04.1
1.10.0-0ubuntu0.16.04.2
1.10.0-0ubuntu0.16.04.3
1.10.0-0ubuntu0.16.04.4
1.10.3-0ubuntu0.16.04.1
1.10.3-0ubuntu0.16.04.2
1.10.3-0ubuntu0.16.04.3
1.10.3-0ubuntu0.16.04.4
1.10.3-0ubuntu0.16.04.5
1.10.3-0ubuntu0.16.04.5+esm1
1.10.3-0ubuntu0.16.04.5+esm2
1.10.3-0ubuntu0.16.04.5+esm3
1.10.3-0ubuntu0.16.04.5+esm4
1.10.3-0ubuntu0.16.04.5+esm5
1.10.3-0ubuntu0.16.04.5+esm6
Ecosystem specific
{
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "nginx",
"binary_version": "1.10.3-0ubuntu0.16.04.5+esm7"
},
{
"binary_name": "nginx-common",
"binary_version": "1.10.3-0ubuntu0.16.04.5+esm7"
},
{
"binary_name": "nginx-core",
"binary_version": "1.10.3-0ubuntu0.16.04.5+esm7"
},
{
"binary_name": "nginx-extras",
"binary_version": "1.10.3-0ubuntu0.16.04.5+esm7"
},
{
"binary_name": "nginx-full",
"binary_version": "1.10.3-0ubuntu0.16.04.5+esm7"
},
{
"binary_name": "nginx-light",
"binary_version": "1.10.3-0ubuntu0.16.04.5+esm7"
}
]
}Ubuntu:Pro:18.04:LTS
nginx
Package
- Name
- nginx
- Purl
- pkg:deb/ubuntu/nginx?arch=source&distro=esm-infra%2Fbionic
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.14.0-0ubuntu1.11+esm2
Affected versions
1.*
1.12.1-0ubuntu2
1.13.6-2ubuntu1
1.13.6-2ubuntu2
1.13.10-1ubuntu1
1.13.12-0ubuntu1
1.14.0-0ubuntu1
1.14.0-0ubuntu1.1
1.14.0-0ubuntu1.2
1.14.0-0ubuntu1.3
1.14.0-0ubuntu1.4
1.14.0-0ubuntu1.5
1.14.0-0ubuntu1.6
1.14.0-0ubuntu1.7
1.14.0-0ubuntu1.9
1.14.0-0ubuntu1.10
1.14.0-0ubuntu1.11
1.14.0-0ubuntu1.11+esm1
Ecosystem specific
{
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "libnginx-mod-http-auth-pam",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-http-cache-purge",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-http-dav-ext",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-http-echo",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-http-fancyindex",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-http-geoip",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-http-headers-more-filter",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-http-image-filter",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-http-lua",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-http-ndk",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-http-perl",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-http-subs-filter",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-http-uploadprogress",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-http-upstream-fair",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-http-xslt-filter",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-mail",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-nchan",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-rtmp",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "libnginx-mod-stream",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "nginx",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "nginx-common",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "nginx-core",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "nginx-extras",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "nginx-full",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
},
{
"binary_name": "nginx-light",
"binary_version": "1.14.0-0ubuntu1.11+esm2"
}
]
}Ubuntu:Pro:20.04:LTS
nginx
Package
- Name
- nginx
- Purl
- pkg:deb/ubuntu/nginx?arch=source&distro=esm-infra%2Ffocal
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.18.0-0ubuntu1.7+esm1
Affected versions
1.*
1.16.1-0ubuntu2
1.16.1-0ubuntu3
1.17.5-0ubuntu1
1.17.6-0ubuntu1
1.17.7-0ubuntu1
1.17.8-0ubuntu1
1.17.8-0ubuntu2
1.17.8-0ubuntu3
1.17.9-0ubuntu1
1.17.9-0ubuntu2
1.17.9-0ubuntu3
1.17.10-0ubuntu1
1.18.0-0ubuntu1
1.18.0-0ubuntu1.2
1.18.0-0ubuntu1.3
1.18.0-0ubuntu1.4
1.18.0-0ubuntu1.5
1.18.0-0ubuntu1.6
1.18.0-0ubuntu1.7
Ecosystem specific
{
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "libnginx-mod-http-auth-pam",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-cache-purge",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-dav-ext",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-echo",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-fancyindex",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-geoip",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-geoip2",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-headers-more-filter",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-image-filter",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-lua",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-ndk",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-perl",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-subs-filter",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-uploadprogress",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-upstream-fair",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-http-xslt-filter",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-mail",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-nchan",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-rtmp",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "libnginx-mod-stream",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "nginx",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "nginx-common",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "nginx-core",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "nginx-extras",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "nginx-full",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
},
{
"binary_name": "nginx-light",
"binary_version": "1.18.0-0ubuntu1.7+esm1"
}
]
}