~ / search / CVE-2026-114426

CVE-2026-114426

Pre-authentication upload parsing permits resource exhaustion

State: published CNA: NCSC.ch CVSS 4.0 8.7 High NVD: deferred

Description

SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with concurrent or slow requests, causing service unavailability.

Affected products

VendorProductVersions
SEPPmail AG SEPPmail Secure Email Gateway (SEG) <15.1.1

References

External links from the record. They lead to third-party sites.