Roundcube Webmail versions older than 1.6.20 and before 1.7.5 contain a flaw in the CSS proxy where the fetched stylesheet is read into memory without a size limit or read timeout. An attacker can supply a URL to a remote host that returns an arbitrarily large response or a slow stream, causing the server to allocate large amounts of memory, potentially crash or become unresponsive. This leads to a denial‑of‑service condition that can affect the entire webmail deployment.

The vulnerability impacts all installations of Roundcube Webmail running versions prior to 1.6.20 and prior to 1.7.5, regardless of operating system or deployment environment, as the flaw resides in the PHP application code.

The CVSS score of 5.3 indicates medium severity. The EPSS score is not available, so the current exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog, implying that no documented exploits are known. Attackers would need network access to the CSS proxy endpoint; the lack of a predefined timeout and size restriction makes it a feasible remote denial‑of‑service vector. No additional preconditions such as privileged user access are required, so any external attacker who can reach the webmail server may threaten availability.