Vulnerabilities

CVSS

4.3 Medium

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Risk score

34.4

Published

2026-07-14

Status

Published

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size.

Weaknesses

CWE-770

Coverage 1

vulnerability

Multiples vulnérabilités dans Roundcube (06 juillet 2026)

Multiple vulnerabilities have been discovered in Roundcube Webmail, impacting versions 1.6.x (prior to 1.6.17) and 1.7.x (prior to 1.7.2). These vulnerabilities include denial-of-service attacks, server-side request forg…

CERT-FR · Jul 6, 2026 Medium

CVE-2026-54432CVE-2026-54433CVE-2026-62641webmailvulnerabilityssrf

All articles mentioning it

Advisories and references

• roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2
• github.com/roundcube/roundcubemail/releases/tag/1.7.2
• github.com/roundcube/roundcubemail/commit/6d1004fd3764a9606c53130b32...
• github.com/roundcube/roundcubemail/releases/tag/1.6.17
• github.com/roundcube/roundcubemail/commit/bf253c72d4293c93fda511b846...