The vulnerability CVE-2026-27651 involves a NULL pointer dereference (CWE-476) in the ngx_mail_auth_http_module of NGINX Open Source. It occurs when CRAM-MD5 or APOP authentication is enabled and the authentication server returns an Auth-Wait response header permitting retries. Under these conditions, specially crafted requests can cause worker processes to terminate unexpectedly, leading to denial of service. The issue affects versions 0.5.15 and 1.29.0 of NGINX Open Source. Red Hat has issued security advisories and updates addressing this vulnerability as part of a broader set of fixes for NGINX. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

Successful exploitation of this vulnerability results in denial of service by causing NGINX worker processes to terminate. This disrupts the availability of services relying on the affected NGINX instance. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild at this time.

Red Hat has released security updates that fix this vulnerability. Users of affected NGINX versions should apply the official patches provided by Red Hat as detailed in their advisories (e.g., RHSA-2026:13634). Since this is not a cloud service, remediation requires updating the affected software versions. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.