What is the CVSS score of CVE-2026-50878?

CVE-2026-50878 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Feuerhamster MailForm are affected by CVE-2026-50878?

Feuerhamster MailForm v1.1.0 contains a denial-of-service vulnerability that allows remote, unauthenticated attackers to disable email form functionality by exhausting server resources through…

How to fix or mitigate CVE-2026-50878?

24 hours: Implement request rate limiting (10-20 requests/minute per IP) and maximum request size enforcement on attachment endpoints; enable resource consumption monitoring. 7 days: Deploy WAF rules to block oversized or malformed attachment submissions; audit systems and workflows dependent on Feuerhamster MailForm to quantify outage impact. 30 days: Evaluate alternative email form solutions with active security support; establish vendor escalation timeline for patch availability; consider disabling non-critical attachment features if business-critical processes can operate without them.

Feuerhamster MailForm CVE-2026-50878

EUVD-2026-36776 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-15 mitre

GHSA-3f8c-7jhj-qx5r

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote network-reachable form endpoint, no auth or interaction required, low complexity to craft the request; impact is availability-only via resource exhaustion, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 13:25 vuln.today

CVSS changed

Jun 16, 2026 - 13:22 NVD

7.5 (HIGH)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the attachment handling component of Feuerhamster MailForm v1.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted request.

AnalysisAI

Denial of service in Feuerhamster MailForm v1.1.0 allows remote unauthenticated attackers to exhaust server resources by sending a crafted request to the attachment handling component. The flaw aligns with CWE-400 (Uncontrolled Resource Consumption) and carries a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/A:H), with no public exploit identified at time of analysis and no inclusion in CISA KEV.

Technical ContextAI

Feuerhamster MailForm is a small web-based mail/contact form application that accepts user-submitted file attachments. The vulnerability sits in the attachment handling code path, which under CWE-400 implies the component fails to bound resource use (memory, CPU, disk, or file handles) when parsing or storing an incoming attachment. A specially crafted request - likely abusing attachment size, count, encoding, or MIME parsing - can be processed in a way that consumes disproportionate server resources, leading to availability loss. The single CPE entry is recorded as 'n/a:n/a', meaning NVD has not yet normalized a vendor/product CPE binding, so automated asset matching against this CVE will fail until that metadata is populated.

RemediationAI

No vendor-released patch identified at time of analysis, and no vendor advisory URL is provided in the references - operators should monitor the Feuerhamster MailForm project for a fixed release above 1.1.0. As compensating controls, place the MailForm endpoint behind a reverse proxy or WAF that enforces strict request-size limits (e.g. cap multipart bodies at a few megabytes) and per-IP rate limits on the attachment-accepting URL; this directly blunts the resource-exhaustion vector with the trade-off that legitimate users sending large attachments will be rejected. Restrict the form to authenticated users or trusted networks if business requirements allow, accepting the loss of public submissions, and review the linked gist at https://gist.github.com/pyuysig/d4c2ace69162c82f1df197ce0f45d63f for any technical detail that would inform a more targeted filter (e.g. specific MIME types or header patterns to block at the proxy).