Apache Pony Mail CVE-2026-41873

Network access to a Pony Mail Lua implementation instance is required - the CVSS vector AV:N confirms remote exploitation over standard HTTP/HTTPS protocols. No authentication, user interaction, or non-default configuration is required (PR:N, UI:N, AC:L). Successful exploitation depends on the presence of an intermediary HTTP infrastructure component (reverse proxy, load balancer, CDN) that parses HTTP differently than Pony Mail's Lua server - this is the standard deployment architecture for production web applications, making the condition common rather than exceptional. Exploitation is NOT limited by requiring administrative access (the vulnerability enables privilege escalation TO admin), special features, or specific Pony Mail configurations. The retired status limits exposure to organizations that deployed Pony Mail Lua before project abandonment and have not migrated away.

Real-world risk is context-dependent. The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates maximum severity for network-accessible instances - remote exploitation with no authentication, low complexity, and complete system compromise. However, the product is officially retired with no vendor support or patch planned, which fundamentally changes the risk calculus. For organizations still running Pony Mail Lua in production, this represents an immediate migration-forcing event rather than a patch-and-monitor scenario. EPSS data is not provided, suggesting limited real-world exploitation visibility, likely because the user base is small for a retired Apache project. No CISA KEV listing indicates no confirmed mass exploitation campaigns. The 'Information Disclosure' and 'Request Smuggling' tags confirm the attack class. SSVC framework assessment: exploitation is proven possible (vendor confirmed), technical impact is total (admin takeover), but automatable exploitation depends on specific reverse proxy configurations. The Python tag likely refers to the unaffected Foal replacement. Critical risk assessment gap: no data on how many production deployments exist or whether they are internet-facing versus internal tools. Organizations must immediately assess whether they are running the Lua implementation and prioritize migration over patching, as the latter is impossible.

An unauthenticated remote attacker crafts HTTP requests with conflicting Content-Length and Transfer-Encoding headers targeting a Pony Mail Lua instance exposed behind a reverse proxy. The front-end proxy and Pony Mail's Lua backend disagree on request boundaries, allowing the attacker to inject a smuggled request fragment that gets appended to the next legitimate user's request. When an administrator accesses the Pony Mail interface, the poisoned request queue causes their session to process the attacker's injected commands, granting the attacker administrative privileges to access archived emails, modify list configurations, or exfiltrate sensitive communications. Public exploit code status unknown, but HTTP request smuggling techniques are well-documented with numerous open-source tools available.