In maddy mail server versions prior to 0.9.3, a user supplied username in LDAP authentication commands is concatenated directly into LDAP search filters and DN strings without proper escaping. This LDAP filter injection allows an attacker to embed arbitrary filter expressions, potentially tricking the directory service into returning records belonging to other users. The vulnerability can also be leveraged to enumerate directory entries or extract attribute values via side‑channel techniques such as oracle responses or timing differences.

foxcpp’s maddy mail server; any deployment using maddy before the 0.9.3 release is affected. The issue spans three code paths: the Lookup filter, the AuthPlain DN template, and the AuthPlain filter.

The flaw carries a CVSS score of 8.2, indicating high severity. Exploitation requires network access to the SMTP submission or IMAP interface, a common setup for email servers. While an EPSS score is not published, the absence of a KEV listing suggests it is not a known widely exploited vulnerability yet, but the high CVSS and the potential for identity spoofing and directory enumeration make it a high‑priority risk.