{
  "document": {
    "aggregate_severity": {
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      },
      {
        "category": "details",
        "text": "* SECURITY UPDATE: Inconsistent login/password state after base64 decoding\n     errors in mail proxy auth\n     - debian/patches/CVE-2025-53859.patch: improve error handling in the\n       plain, login and cram-md5 auth methods so login and password storage\n       are not left in an inconsistent state in the session after a decoding\n       error in ngx_mail_handler.c\n     - CVE-2025-53859",
        "title": "Details"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783592384",
        "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783592384"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_docker/debian13/advisories/2026/clsa-2026_1783592384.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-07-09T10:20:23Z",
      "generator": {
        "date": "2026-07-09T10:20:23Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CLSA-2026:1783592384",
      "initial_release_date": "2026-07-09T10:20:23Z",
      "revision_history": [
        {
          "date": "2026-07-09T10:20:23Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    },
    "title": "Fix CVE(s): CVE-2025-53859"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Debian 13",
                "product": {
                  "name": "Debian 13",
                  "product_id": "Debian-13",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:debian:debian_linux:13:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Debian"
          }
        ],
        "category": "vendor",
        "name": "Software in the Public Interest, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64",
                "product": {
                  "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64",
                  "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els9?arch=arm64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64",
                "product": {
                  "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64",
                  "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els8?arch=arm64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64",
                "product": {
                  "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64",
                  "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els5?arch=arm64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64",
                "product": {
                  "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64",
                  "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els4?arch=arm64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64",
                "product": {
                  "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64",
                  "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els2?arch=arm64&os_name=debian&os_version=13"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64",
                "product": {
                  "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64",
                  "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els9?arch=amd64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64",
                "product": {
                  "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64",
                  "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els8?arch=amd64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64",
                "product": {
                  "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64",
                  "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els5?arch=amd64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64",
                "product": {
                  "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64",
                  "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els4?arch=amd64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64",
                "product": {
                  "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64",
                  "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els2?arch=amd64&os_name=debian&os_version=13"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64",
                "product": {
                  "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64",
                  "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els1?arch=amd64&os_name=debian&os_version=13"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64"
        },
        "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64"
        },
        "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64"
        },
        "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64"
        },
        "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64"
        },
        "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64"
        },
        "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64"
        },
        "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64"
        },
        "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64"
        },
        "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64"
        },
        "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64",
        "relates_to_product_reference": "Debian-13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64 as a component of Debian 13",
          "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64"
        },
        "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-13"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-53859",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "description",
          "text": "NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64",
          "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64"
        ],
        "known_affected": [
          "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64",
          "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64",
          "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64",
          "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64",
          "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64",
          "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64",
          "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64",
          "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64",
          "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2025-53859"
        }
      ],
      "release_date": "2025-08-13T14:46:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-09T10:19:47.587361Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783592384",
          "product_ids": [
            "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64",
            "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64"
          ],
          "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783592384"
        },
        {
          "category": "none_available",
          "date": "2025-08-13T14:46:00Z",
          "details": "Affected",
          "product_ids": [
            "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64",
            "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64",
            "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64",
            "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64",
            "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64",
            "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64",
            "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64",
            "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64",
            "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64",
            "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ]
    }
  ]
}