Every CVE Search/ Get API key

CVE-2026-114726

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection...

5.8 MediumFix available

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.40%Up 0.1 points since Oct 22, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.8

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.

Record
CVE-2026-114726
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-99
Updated
2026-11-02
EUVDEUVD-2026-107703 5.8

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.

Record
EUVD-2026-107703
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hpmj-jmwh-pghr 5.8

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection...

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.

Record
GHSA-hpmj-jmwh-pghr
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-99
Updated
2026-11-02
NVD 5.8

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.

Record
CVE-2026-114726
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-99
Updated
2026-11-02
OSV 5.8

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.

Record
CVE-2026-114726
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-99
Updated
2026-11-02
OSVDEBIAN-CVE-2026-114726 5.8

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.

Record
DEBIAN-CVE-2026-114726
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-114726 5.8

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.

Record
UBUNTU-CVE-2026-114726
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
roundcube
Debian:12
 All versions, plus listed versions
1.6.1+dfsg-11.6.10+dfsg-11.6.10+dfsg-21.6.11+dfsg-11.6.12+dfsg-1
Show 34 moreShow less
1.6.13+dfsg-11.6.14+dfsg-11.6.15+dfsg-11.6.16+dfsg-11.6.17+dfsg-11.6.18+dfsg-11.6.19+dfsg-11.6.2+dfsg-11.6.20+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-21.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1+deb12u101.6.5+dfsg-1+deb12u111.6.5+dfsg-1+deb12u121.6.5+dfsg-1+deb12u21.6.5+dfsg-1+deb12u31.6.5+dfsg-1+deb12u41.6.5+dfsg-1+deb12u51.6.5+dfsg-1+deb12u61.6.5+dfsg-1+deb12u71.6.5+dfsg-1+deb12u81.6.5+dfsg-1+deb12u91.6.5+dfsg-1~deb12u11.6.6+dfsg-11.6.6+dfsg-21.6.7+dfsg-11.6.8+dfsg-11.6.8+dfsg-21.6.9+dfsg-11.6.9+dfsg-2
 None known
roundcube
Debian:13
 before 1.6.20+dfsg-0+deb13u1, plus listed versions
1.6.11+dfsg-11.6.12+dfsg-0+deb13u11.6.12+dfsg-11.6.13+dfsg-0+deb13u11.6.13+dfsg-1
Show 11 moreShow less
1.6.14+dfsg-11.6.15+dfsg-0+deb13u11.6.15+dfsg-11.6.16+dfsg-0+deb13u11.6.16+dfsg-11.6.17+dfsg-0+deb13u11.6.17+dfsg-11.6.18+dfsg-0+deb13u11.6.18+dfsg-11.6.19+dfsg-0+deb13u11.6.19+dfsg-1
1.6.20+dfsg-0+deb13u1
roundcube
Debian:14
 before 1.6.20+dfsg-1, plus listed versions
1.6.11+dfsg-11.6.12+dfsg-11.6.13+dfsg-11.6.14+dfsg-11.6.15+dfsg-1
Show 4 moreShow less
1.6.16+dfsg-11.6.17+dfsg-11.6.18+dfsg-11.6.19+dfsg-1
1.6.20+dfsg-1
roundcube
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.1.1+dfsg.1-21.1.2+dfsg.1-51.1.3+dfsg.1-11.1.4+dfsg.1-11.2~beta+dfsg.1-0ubuntu1
Show 8 moreShow less
1.2~beta+dfsg.1-0ubuntu1+esm11.2~beta+dfsg.1-0ubuntu1+esm21.2~beta+dfsg.1-0ubuntu1+esm31.2~beta+dfsg.1-0ubuntu1+esm41.2~beta+dfsg.1-0ubuntu1+esm51.2~beta+dfsg.1-0ubuntu1+esm61.2~beta+dfsg.1-0ubuntu1+esm71.2~beta+dfsg.1-0ubuntu1+esm8
 None known
roundcube
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.3.0+dfsg.1-11.3.1+dfsg.1-11.3.3+dfsg.1-11.3.3+dfsg.1-21.3.6+dfsg.1-1
Show 8 moreShow less
1.3.6+dfsg.1-1ubuntu0.1~esm11.3.6+dfsg.1-1ubuntu0.1~esm21.3.6+dfsg.1-1ubuntu0.1~esm31.3.6+dfsg.1-1ubuntu0.1~esm41.3.6+dfsg.1-1ubuntu0.1~esm51.3.6+dfsg.1-1ubuntu0.1~esm61.3.6+dfsg.1-1ubuntu0.1~esm71.3.6+dfsg.1-1ubuntu0.1~esm8
 None known
roundcube
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.3.8+dfsg.1-21.3.10+dfsg.1-11.4.1+dfsg.1-21.4.2+dfsg.1-11.4.2+dfsg.1-2
Show 9 moreShow less
1.4.3+dfsg.1-11.4.3+dfsg.1-1ubuntu0.1~esm11.4.3+dfsg.1-1ubuntu0.1~esm21.4.3+dfsg.1-1ubuntu0.1~esm31.4.3+dfsg.1-1ubuntu0.1~esm41.4.3+dfsg.1-1ubuntu0.1~esm51.4.3+dfsg.1-1ubuntu0.1~esm61.4.3+dfsg.1-1ubuntu0.1~esm71.4.3+dfsg.1-1ubuntu0.1~esm8
 None known
roundcube
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.4.11+dfsg.1-41.5.0+dfsg.1-21.5.0+dfsg.1-2ubuntu0.1~esm11.5.0+dfsg.1-2ubuntu0.1~esm21.5.0+dfsg.1-2ubuntu0.1~esm31.5.0+dfsg.1-2ubuntu0.1~esm41.5.0+dfsg.1-2ubuntu0.1~esm51.5.0+dfsg.1-2ubuntu0.1~esm6
 None known
roundcube
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.6.2+dfsg-11.6.4+dfsg-11.6.5+dfsg-11.6.6+dfsg-11.6.6+dfsg-2
Show 4 moreShow less
1.6.6+dfsg-2ubuntu0.11.6.6+dfsg-2ubuntu0.1+esm11.6.6+dfsg-2ubuntu0.1+esm21.6.6+dfsg-2ubuntu0.1+esm3
 None known
roundcube
Ubuntu:26.10
 All versions, plus listed versions
1.6.11+dfsg-1
 None known
roundcube
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
1.6.11+dfsg-11.6.11+dfsg-1ubuntu0.26.04.1~esm1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-114726 is a medium vulnerability (CVSS 5.8) in Bulwarkmail Webmail, published October 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in roundcube 1.6.20+dfsg-0+deb13u1.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open