From 4f32484e99671d107d0d6c27c0c674f528d8c9ca Mon Sep 17 00:00:00 2001 From: Sergey Kandaurov Date: Wed, 18 Mar 2026 16:39:37 +0400 Subject: [PATCH] Mail: fixed clearing s->passwd in auth http requests. Previously, it was not properly cleared retaining length as part of authenticating with CRAM-MD5 and APOP methods that expect to receive password in auth response. This resulted in null pointer dereference and worker process crash in subsequent auth attempts with CRAM-MD5. Reported by Arkadi Vainbrand. (cherry picked from commit 0f71dd8ea94ab8c123413b2e465be12a35392e9c) CVE: CVE-2026-27651 Upstream-Status: Backport [https://github.com/nginx/nginx/commit/0f71dd8ea94ab8c123413b2e465be12a35392e9c] Signed-off-by: Ankur Tyagi --- src/mail/ngx_mail_auth_http_module.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/mail/ngx_mail_auth_http_module.c b/src/mail/ngx_mail_auth_http_module.c index 27f64b92e..d931183ae 100644 --- a/src/mail/ngx_mail_auth_http_module.c +++ b/src/mail/ngx_mail_auth_http_module.c @@ -1325,7 +1325,7 @@ ngx_mail_auth_http_create_request(ngx_mail_session_t *s, ngx_pool_t *pool, b->last = ngx_cpymem(b->last, "Auth-Salt: ", sizeof("Auth-Salt: ") - 1); b->last = ngx_copy(b->last, s->salt.data, s->salt.len); - s->passwd.data = NULL; + ngx_str_null(&s->passwd); } b->last = ngx_cpymem(b->last, "Auth-Protocol: ",