The vulnerability is caused by inconsistent interpretation of HTTP requests in the retired Lua implementation of Apache Pony Mail, allowing an attacker to smuggle HTTP requests and gain administrative privileges. This flaw is classified as CWE-444 and would let an attacker fully compromise the administrative control of the mail server, affecting confidentiality, integrity, and availability.

The problem affects the deprecated Lua version of Pony Mail from the Apache Software Foundation; all versions released before retirement are impacted. The Python implementation, known as Pony Mail Foal, is not affected, but it has not yet been released. Because the Lua implementation is no longer maintained, there are no vendor patches or updates available.

The exploit allows remote privilege escalation to full admin rights, making the risk very high. The CVSS score of 9.8 reflects the very high risk. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating that public exploit data may be limited, but the potential impact remains severe. Attackers would need the ability to send crafted HTTP requests to the mail server, typically a remote network attacker. Without an official fix, the threat persists until the product is removed or replaced.