SEPPmail Secure Email Gateway versions before 15.0.3 allow an attacker to craft an email with an excessively long subject line. The gateway fails to properly validate the length of the subject and, as a result, removes or suppresses the security tags that would normally be attached to the message. This flaw means that messages that should be flagged for handling or compliance may be treated as ordinary email, increasing the risk of confidential information being delivered outside of intended controls. The weakness is classified as CWE‑20, improper input validation.

The vulnerability affects SEPPmail Secure Email Gateway installations running any firmware version older than 15.0.3. No other vendor or product variations are listed in this CVE.

The CVSS score of 5.3 indicates moderate severity. EPSS data is unavailable and the vulnerability is not in CISA’s KEV catalog, suggesting limited widespread exploitation so far. The likely attack vector is simple: a sender can transmit a crafted email with a subject longer than the gateway expects. While the flaw does not provide remote code execution or privilege escalation, it can bypass automated tagging, leading to potential policy violations or data leakage. Organizations with automated security tagging should consider the risk of misclassification as part of their overall threat model.