EUVD-2026-26065Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
UNSUPPORTED WHEN ASSIGNED Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin account takeover.
This issue affects all versions of the Lua implementation of Pony Mail. There is a Python implementation under development under the name "Pony Mail Foal" that is not affected by this issue, but hasn't been released yet.
As the Lua implementation of this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
HTTP request smuggling in Apache Pony Mail (Lua implementation) enables remote unauthenticated attackers to achieve complete admin account takeover with critical impact across confidentiality, integrity, and availability. This affects all versions of the retired Lua codebase - Apache has abandoned support with no patch planned, recommending migration to alternative solutions. CVSS 9.8 critical severity reflects trivial network-based exploitation requiring no authentication or user interaction.
Technical ContextAI
HTTP request smuggling (CWE-444) exploits inconsistent parsing of HTTP message boundaries between front-end proxies and back-end servers. When intermediate infrastructure (load balancers, reverse proxies, WAFs) and the application server disagree on where one HTTP request ends and another begins - typically via conflicting Content-Length and Transfer-Encoding headers, or malformed chunked encoding - attackers can inject malicious requests that appear to originate from other users or bypass security controls. In Pony Mail's Lua implementation, this parsing inconsistency allows an attacker to poison the request queue such that subsequent requests appear to come from administrative sessions, enabling session hijacking and privilege escalation. The CPE string cpe:2.3:a:apache:pony_mail:*:*:*:*:*:*:*:* indicates all versions of the Lua implementation are affected. The Python-based 'Pony Mail Foal' rewrite is not vulnerable, suggesting the issue stems from Lua-specific HTTP parsing libraries or Pony Mail's integration with the Lua web server stack.
RemediationAI
Apache provides no patch - the Lua implementation is permanently retired. Immediate migration to an alternative mailing list archive solution is required for production deployments. Organizations with trusted-user-only internal instances may accept residual risk with compensating controls: restrict network access to the Pony Mail instance via firewall rules permitting only authenticated VPN users or specific IP ranges (trade-off: breaks public archive access); deploy a hardened reverse proxy (nginx, Apache httpd) configured with strict HTTP parsing that normalizes requests before reaching Pony Mail (trade-off: requires expertise in request smuggling mitigations like rejecting ambiguous Content-Length/Transfer-Encoding combinations, may break legitimate clients); implement runtime application firewall rules detecting smuggling patterns such as duplicate or conflicting headers (trade-off: potential false positives, ongoing signature maintenance). Monitor the Pony Mail Foal Python rewrite at https://lists.apache.org/thread/1c7jtxjobh280kqc13fzw1cg57xrz951 for production-ready releases as the long-term replacement path. These controls reduce but cannot eliminate risk against a CVSS 9.8 vulnerability - migration remains the only complete remediation.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today