CVE-2014-3556

score

<0.1

cvss

6.8

epss

7.8%

published

2014-12-29

kev added

—

first seen

2026-10-21

nginx 1.5.x, 1.6.x before 1.6.1, and 1.7.x before 1.7.4 contain a plaintext command injection caused by improper I/O buffering restrictions in STARTTLS implementation, letting man-in-the-middle attackers insert commands into encrypted SMTP sessions, exploit requires man-in-the-middle position.