rootpwn

high · CVSS v3 7.5

CVE-2026-93563

CVE-2026-93563 is a high‑severity denial‑of‑service vulnerability in the SmtpResponseDecoder component. The flaw allows an attacker to send

Overview

CVE-2026-93563 is a high‑severity denial‑of‑service vulnerability in the SmtpResponseDecoder component. The flaw allows an attacker to send an unbounded number of multi‑line SMTP responses, causing the decoder to accumulate data until memory exhaustion. This can disrupt mail services and degrade availability.

Description

Unbounded multi-line response accumulation in SmtpResponseDecoder leads to memory-exhaustion DoS

Impact

The vulnerability compromises Availability by exhausting memory, leading to service interruption. It affects all systems that use the vulnerable decoder, including mail servers, clients, and any application that processes SMTP responses. Defenders should monitor memory usage and ensure that the decoder is patched or limited.

Remediation

Apply the vendor‑issued patch that limits the size of accumulated SMTP responses or update to the latest library version. As a temporary mitigation, configure the SMTP server to enforce a maximum response size or drop connections that exceed a threshold. Additionally, enable resource limits or sandboxing to contain memory usage.

Risk context

Severity is high with CVSS 7.5. No EPSS data is available, but the potential for widespread DoS makes it urgent to patch.

Affected products

  • Apache Commons Net
  • JavaMail API
  • SMTP client libraries
  • Mail server software

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
—

DoS SMTP Memory Exhaustion High Severity Denial of Service Decoder Mail Server

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-93566

### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling. ### Details `io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present: ```java int extensionsStart = line.bytesBefore((byte) ';'); if (extensionsStart == -1) { return; } ``` According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A `chunk-size = 1*HEXDIG` ### PoC ```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "0\rX\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch

View analysis