Roundcube Webmail EUVD-2026-107998

Exploitation requires the attacker to cause the utils/modcss CSS proxy action to fetch a stylesheet URL pointing at a host they control; the vulnerable code path read that remote response into memory in full with no size limit and no read timeout, allowing memory exhaustion. In practice the modcss endpoint serves Roundcube's HTML-mail CSS rewriting, so reaching it typically presupposes a valid webmail session, which limits exposure to users able to interact with the application rather than purely anonymous internet attackers (the supplied CVSS PR:N notwithstanding). Impact is bounded to availability - there is no data disclosure or modification. The limiting factors are therefore the reachability of the modcss action, any session/authentication gate in front of it, and the fact that the fix (5 MB cap, streamed reads, 10s timeout) is already available in 1.6.20 and 1.7.5.

This is a medium-severity denial-of-service issue (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with availability-only impact (A:L) and no confidentiality or integrity consequences. The CVSS vector asserts network-reachable, low-complexity, unauthenticated exploitation, but the affected endpoint - the utils/modcss CSS proxy action in Roundcube - is normally reachable only within an authenticated webmail session, so the PR:N claim likely overstates exposure; verify whether modcss is reachable pre-authentication in your deployment. No EPSS score, no CISA KEV listing, and no public exploit were provided in the intelligence set, which is consistent with a resource-exhaustion bug rather than a code-execution flaw. Taken together these signals point to a low real-world priority: this is a high-visibility product but a bounded, availability-only weakness that is patched. Treat it as routine patch-cycle maintenance rather than an emergency, while still applying the fix because unauthenticated DoS cannot be fully ruled out given the stated vector.

An attacker causes the Roundcube CSS proxy (utils/modcss) to fetch a stylesheet from a host they control that serves a very large or never-ending response. Because the fetched stylesheet was read into memory in full with no size limit and no read timeout, a single request - or a handful in parallel - forces the PHP worker to buffer unbounded data and exhausts server memory, degrading or crashing the webmail service. No public proof-of-concept was identified in the provided data.