CVE-2026-41873
** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin account takeover. This issue affects all versions of the Lua implementation of Pony Mail. There is a Python implementation under development under the name "Pony Mail Foal" that is not affected by this issue, but hasn't been released yet. As the Lua implementation of this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.44%
- CWE
- CWE-444
- Published
- 2026-04-28
- Last modified
- 2026-04-29
Affected products
- Apache Software Foundation Pony Mail
Weakness type
Related vulnerabilities
- CVE-2026-81356 — Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-19203 — A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty...
- CVE-2026-18540 — undici vulnerable to downstream response splitting via retry interceptor
- CVE-2026-84380 — HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
- CVE-2026-84363 — Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
- CVE-2026-78605 — Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure
- CVE-2026-73812 — inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
- CVE-2026-73276 — inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i