Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.
Published: 2026-10-22
Score: 5.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Mail header injection
Action: Patch Update
AI Analysis

Impact

Roundcube Webmail allows a mail header injection flaw in the Bounce (resend) action. The decoding routine rcube_mime::decode_address_list() fails to strip CR and LF control characters when processing the From display name, so a crafted message containing these characters in an encoded word can inject arbitrary email headers into the message that is emitted when a user triggers a bounce.

Affected Systems

All releases of Roundcube Webmail before version 1.6.20 and all 1.7.x releases before 1.7.5 are affected.

Risk and Exploitability

The flaw carries a CVSS score of 5.8, indicating moderate severity, and an EPSS score of less than 1%. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires an attacker to craft a message with a malicious From display name, and then a victim must use the Bounce feature to trigger the injection. When the victim re‑bounces the message, the injected headers are included in the rebound message.

Generated by OpenCVE AI on October 29, 2026 at 22:10 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Roundcube to version 1.6.20 or later for 1.6.x releases, or to 1.7.5 or later for 1.7.x releases to apply the vendor patch.
  • If unable to upgrade immediately, disable or restrict the Bounce feature to prevent exploitation until a patch is applied.
  • Monitor bounce logs for suspicious headers and investigate any anomalies.

Generated by OpenCVE AI on October 29, 2026 at 22:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6579-1 roundcube security update
History

Thu, 29 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title Mail Header Injection via Bounce Action in Roundcube Webmail roundcubemail: roundcubemail: Mail header injection via crafted From display name in bounce action
Weaknesses CWE-93
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 28 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
Title Mail Header Injection via Bounce Action in Roundcube Webmail

Thu, 22 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Description Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.
First Time appeared Roundcube
Roundcube webmail
Weaknesses CWE-99
CPEs cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
Vendors & Products Roundcube
Roundcube webmail
References
Metrics cvssV3_1

{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N'}

Subscriptions

Roundcube Webmail
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-28T02:17:15.141Z

Reserved: 2026-10-22T01:55:25.334Z

Link: CVE-2026-114726

cve-icon Vulnrichment

Updated: 2026-10-28T02:17:11.492Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-22T02:17:00.640

Modified: 2026-10-29T14:16:00.170

Link: CVE-2026-114726

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-22T01:55:25Z

Links: CVE-2026-114726 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T22:15:04Z

Weaknesses
  • CWE-93

    Improper Neutralization of CRLF Sequences ('CRLF Injection')

  • CWE-99

    Improper Control of Resource Identifiers ('Resource Injection')