What is the CVSS score of CVE-2026-48187?

CVE-2026-48187 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

OTRS CVE-2026-48187

EUVD-2026-33553 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-06-01 OTRS

GHSA-v95g-89m8-9p9r

Denial Of Service Otrs Otrs Community Edition

5.7

CVSS 3.1 · Vendor: OTRS

Severity by source

Vendor (OTRS) PRIMARY

5.7 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Primary rating from Vendor (OTRS) · only source for this CVE.

CVSS VectorVendor: OTRS

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 04:23 vuln.today

DescriptionCVE.org

An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows excessive allocation which may lead to the abortion of the webserver.This issue affects OTRS:

8.0.X
2023.X
2024.X
2025.X
2026.X before 2026.4.X

Please note that ((OTRS)) Community Edition 6.x, OTRS 7.x and products based on the ((OTRS)) Community Edition also very likely to be affected

AnalysisAI

Uncontrolled resource allocation in OTRS's e-mail handling subsystem allows a low-privileged authenticated user to trigger unbounded memory or resource consumption, ultimately aborting the webserver and causing a denial of service against the entire OTRS interface. Affected versions span OTRS 8.0.X through 2026.X prior to 2026.4.X, and the ((OTRS)) Community Edition 6.x and OTRS 7.x branches are noted by the vendor as very likely affected as well. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

OTRS is an enterprise IT service management and ticketing platform (CPE: cpe:2.3:a:otrs_ag:otrs and cpe:2.3:a:otrs_ag:((otrs))_community_edition). The vulnerability is rooted in CWE-400 (Uncontrolled Resource Consumption): the e-mail ingestion and processing pipeline lacks allocation caps or rate-limiting controls, so processing a specially crafted inbound message can cause the application to allocate resources without bound. This exhaustion propagates upward to the hosting webserver process, which aborts under memory or resource pressure. The scope is unchanged (S:U in CVSS), meaning the impact is confined to the OTRS application tier rather than escaping to the underlying OS, but a webserver abort renders the entire OTRS web interface unavailable to all users.

RemediationAI

The vendor-confirmed fix is upgrade to OTRS 2026.4.X or later, which resolves the uncontrolled resource allocation in e-mail handling; see OTRS Security Advisory 2026-06 at https://otrs.com/release-notes/otrs-security-advisory-2026-06/. For OTRS branches 8.0.X, 2023.X, 2024.X, and 2025.X, no patched release is confirmed from available data - organizations on these branches should contact OTRS AG directly for guidance or an upgrade path. For ((OTRS)) Community Edition 6.x and OTRS 7.x, which are noted as very likely affected but for which no vendor patch path exists, specific compensating controls include: applying inbound e-mail size caps and rate limits at the MTA layer (e.g., Postfix smtpd_message_size_limit and smtpd_client_message_rate_limit) to reduce the volume and size of messages reaching OTRS's processor; restricting OTRS web interface access to internal networks or VPN to raise the authentication barrier; and auditing which accounts hold agent or customer portal credentials to minimize the pool of potential low-privileged attackers. Note that MTA-level rate limiting reduces attack surface but does not eliminate the underlying vulnerability if a sufficiently crafted single message can trigger the condition.