high · CVSS v3 4.9 · CVSS v4 8.2 · EPSS 0.00309

CVE-2026-108121

CVE-2026-108121 is a high‑severity flaw in SME Server 11.0rc1‑215 that lets a privileged user inject Apache directives during domain creatio

Overview

CVE-2026-108121 is a high‑severity flaw in SME Server 11.0rc1‑215 that lets a privileged user inject Apache directives during domain creation. The injected directives corrupt httpd.conf, causing Apache to fail to start after reboot and leading to a denial‑of‑service of the web server and its virtual hosts. The issue is exploitable only by users with high privileges on the host.

Description

Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from starting after a server reboot, resulting in a denial-of-service (DoS) condition affecting the web server and its hosted virtual hosts.

Impact

Confidentiality: No direct data exposure. Integrity: The attacker can alter Apache configuration, effectively tampering with the web server's behavior. Availability: The server becomes unavailable after reboot, denying service to all hosted sites. Defenders: System administrators and security teams managing SME Server installations are impacted.

Remediation

Apply the official patch for SME Server 11.0rc1-215 that fixes the domain creation logic, or upgrade to a newer release where the issue is resolved. As an interim measure, restrict high‑privilege accounts from using the domain creation interface and monitor httpd.conf for unauthorized changes. Ensure that Apache is configured to start automatically only after verifying configuration integrity.

Risk context

Severity is high with CVSS v3 score 4.9 and CVSS v4 8.2, but the EPSS is low (0.00309), indicating a low probability of exploitation in the wild. Nonetheless, the impact on availability warrants timely patching.

Affected products

  • koozali SME Server 11.0rc1-215

Scores

Severity
high
CVSS v2
5
CVSS v3
4.9
CVSS v4
8.2
EPSS
0.00309

DoS Apache SME Server Configuration Privilege Escalation High Severity

← All CVEs

Related CVEs

high

CVE-2026-112107

A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis

high

CVE-2026-112081

A deserialization flaw in HanLP’s load function allows remote attackers to supply a crafted classpath argument, potentially leading to arbitrary code execution. The issue affects all versions up to 2.1.0-beta.64 and can be triggered via network interfaces. It has been publicly disclosed and remains unpatched.

View analysis

high

CVE-2026-112082

The CVE-2026-112082 vulnerability affects the SGLang library (up to version 0.5.19) in the Expert‑Distribution Recording Endpoint. It allows remote attackers to trigger a denial‑of‑service by manipulating the Scheduler.expert_distribution_handle function. The flaw is publicly documented and the fix is pending merge.

View analysis

high

CVE-2026-112086

ESPnet up to version 202610.post2 contains a deserialization flaw in the build_model function of inference_model.py. An attacker can manipulate the _target_ argument to trigger arbitrary code execution remotely. A public patch (f217b24f06de55e332cab10231469d5890dbbe00) is available.

View analysis