Vulnerability · Published Oct 22, 2026 · Assigned by mitre
CVE-2026-114731
Medium 5.3
In plain English
A medium-severity resource allocation without limits in Webmail from Roundcube. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit “Add a size limit to the CSS proxy content processing”, which caps the response at 5 MB, reads it as a stream and applies a read timeout.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | roundcube | no fix listed | DEBIAN-CVE-2026-114731 |
| Debian:13 | roundcube | 1.6.20+dfsg-0+deb13u1 | DEBIAN-CVE-2026-114731 |
| Debian:14 | roundcube | 1.6.20+dfsg-1 | DEBIAN-CVE-2026-114731 |
| Ubuntu:26.10 | roundcube | no fix listed | UBUNTU-CVE-2026-114731 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://bugs.debian.org/1151279 issue-tracking, third-party-advisory
- https://github.com/roundcube/roundcubemail/commit/2c9f6da692fa37cad2aaf85d5b127b583d22b264 patch
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 vendor-advisory, release-notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5 release-notes, patch
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 release-notes, patch
- https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126 patch