CVE-2026-27651 is a denial of service vulnerability in F5 NGINX Open Source related to the ngx_mail_auth_http_module. When this module is enabled, and CRAM-MD5 or APOP authentication is used with an authentication server that permits retries via the Auth-Wait response header, specially crafted requests can cause worker processes to terminate due to a NULL pointer dereference (CWE-476). This vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts availability only. Red Hat has issued security advisories and updates for affected Red Hat Enterprise Linux versions to address this issue.

The vulnerability causes denial of service by terminating NGINX worker processes when certain mail authentication configurations are used. This results in service disruption and reduced availability of the affected NGINX server. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been reported at this time.

Red Hat has released security updates for affected packages in Red Hat Enterprise Linux 10.0 Extended Update Support and other supported variants. Applying these official vendor updates will remediate the vulnerability. Users should refer to the Red Hat advisories (e.g., RHSA-2026:13634) for detailed update instructions. Since this is not a cloud service, remediation depends on applying these patches. Patch status is confirmed by vendor advisories. No alternative mitigations are specified.