Secuno
ENNL
Book demo

CVE-2026-41873

Apache Pony Mail vulnerability

9.8 CRITICALEPSS 0.74%
  1. Published28 Apr 2026

Description

** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin account takeover. This issue affects all versions of the Lua implementation of Pony Mail. There is a Python implementation under development under the name "Pony Mail Foal" that is not affected by this issue, but hasn't been released yet. As the Lua implementation of this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache Pony Mailall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-8877310.0
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')…
CVE-2026-863509.1
Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling')…
CVE-2026-935698.2
A flaw was found in Netty. A remote unauthenticated attacker can exploit a…
CVE-2026-922389.8
A maliciously constructed mail header could lead to multiple fields being parsed as…
CVE-2026-692178.7
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s…
CVE-2026-692058.7
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s…

Frequently asked

Is CVE-2026-41873 being actively exploited?

CVE-2026-41873 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.74%.

How severe is CVE-2026-41873?

CVE-2026-41873 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.74% probability of exploitation.

Which products are affected by CVE-2026-41873?

Affected products include Apache Pony Mail.

How do I fix CVE-2026-41873?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-41873 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.