{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114731", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-10-22T02:12:34.183Z", "datePublished": "2026-10-22T02:12:34.577Z", "dateUpdated": "2026-10-22T02:12:34.577Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Webmail", "repo": "https://github.com/roundcube/roundcubemail/", "vendor": "Roundcube", "versions": [{"lessThan": "1.6.20", "status": "affected", "version": "1.6.0", "versionType": "semver"}, {"lessThan": "1.7.5", "status": "affected", "version": "1.7.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit \u201cAdd a size limit to the CSS proxy content processing\u201d, which caps the response at 5 MB, reads it as a stream and applies a read timeout."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-22T02:12:34.577Z"}, "references": [{"tags": ["issue-tracking", "third-party-advisory"], "url": "https://bugs.debian.org/1151279"}, {"tags": ["patch"], "url": "https://github.com/roundcube/roundcubemail/commit/2c9f6da692fa37cad2aaf85d5b127b583d22b264"}, {"tags": ["vendor-advisory", "release-notes"], "url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"}, {"tags": ["release-notes", "patch"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5"}, {"tags": ["release-notes", "patch"], "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20"}, {"tags": ["patch"], "url": "https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.6.0", "versionEndExcluding": "1.6.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.7.0", "versionEndExcluding": "1.7.5"}]}]}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Webmail", "repo": "https://github.com/roundcube/roundcubemail/", "vendor": "Roundcube", "versions": [{"lessThan": "1.6.20", "status": "affected", "version": "1.6.0", "versionType": "semver"}, {"lessThan": "1.7.5", "status": "affected", "version": "1.7.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit \u201cAdd a size limit to the CSS proxy content processing\u201d, which caps the response at 5 MB, reads it as a stream and applies a read timeout."}], "id": "CVE-2026-114731", "lastModified": "2026-10-22T16:45:49.550", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2026-10-22T03:16:38.363", "references": [{"source": "cve@mitre.org", "url": "https://bugs.debian.org/1151279"}, {"source": "cve@mitre.org", "url": "https://github.com/roundcube/roundcubemail/commit/2c9f6da692fa37cad2aaf85d5b127b583d22b264"}, {"source": "cve@mitre.org", "url": "https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126"}, {"source": "cve@mitre.org", "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20"}, {"source": "cve@mitre.org", "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5"}, {"source": "cve@mitre.org", "url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "cve@mitre.org", "type": "Primary"}]}

{"bugzilla": {"description": "roundcubemail: roundcubemail: Denial of Service via CSS proxy memory exhaustion", "id": "2558746", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558746"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-770", "details": ["Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit \u201cAdd a size limit to the CSS proxy content processing\u201d, which caps the response at 5 MB, reads it as a stream and applies a read timeout.", "A flaw was found in Roundcube Webmail. This flaw allows a remote attacker to trigger a Denial of Service (DoS) by exhausting server memory. The application's stylesheet proxy fails to enforce size limits or read timeouts when retrieving external content. By directing the proxy to fetch an attacker-controlled stylesheet, an attacker can force the server to load unbounded data into memory, causing the application to become unresponsive."], "mitigation": {"lang": "en:us", "value": "Update to roundcubemail 1.6.20 (1.6 LTS) or 1.7.5, which add a 5 MB size limit, streamed content reading, and a read timeout to the CSS proxy. Restricting or disabling the modcss/CSS proxy feature reduces exposure."}, "name": "CVE-2026-114731", "public_date": "2026-10-22T02:12:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114731\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114731\nhttps://bugs.debian.org/1151279\nhttps://github.com/roundcube/roundcubemail/commit/2c9f6da692fa37cad2aaf85d5b127b583d22b264\nhttps://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.6.20\nhttps://github.com/roundcube/roundcubemail/releases/tag/1.7.5\nhttps://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"], "statement": "A flaw was found in Roundcube Webmail's CSS proxy (utils/modcss action). A remote unauthenticated attacker can direct the proxy to fetch an attacker-controlled stylesheet that is read fully into memory with no size limit or read timeout, exhausting server memory and causing denial of service. Fixed in 1.6.20 and 1.7.5 (5 MB cap, streamed read, read timeout). Red Hat does not ship roundcubemail; community builds on fedora-all and epel-all are affected and delegated.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.6.0,1.6.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.7.0,1.7.5)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Webmail", "source": "cna", "vendor": "Roundcube"}, "product": "webmail", "vendor": "roundcube"}], "created": "2026-10-22T06:15:11.712276+00:00", "title": "Uncontrolled Resource Consumption in Roundcube Webmail CSS Proxy Leading to Server Memory Exhaustion", "updated": "2026-10-22T07:30:08.794322+00:00", "vendors": ["roundcube", "roundcube$PRODUCT$webmail"]}