138 matches found
Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
Summary Nodemailer's SMTP client applies four regular expressions to a peer's EHLO response to detect the supported SASL mechanisms. Each pattern uses an alternation with two overlapping whitespace-matching sub-patterns, which produces quadratic On^2 backtracking whenever the mechanism name is...
Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service
Summary The SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether that entry is still a partial continuation reply on every line. The partial-response test runs str.slicestr.lastIndexOf'\n' + ...
EUVD-2026-101755
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...
UBUNTU-CVE-2026-110872
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...
CVE-2026-110872
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...
DEBIAN-CVE-2026-110872
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...
CVE-2026-110872
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...
CVE-2026-110872
The Nodemailer library (versions 3.0.0 before 10.0.10) contains a quadratic complexity denial of service vulnerability within the SMTP client reply parser, specifically affecting SMTPConnection._onData and isPartialResponse. A malicious SMTP server or an on-path attacker can trigger this by strea...
CVE-2026-110872 Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...
CVE-2026-110872 Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...
CVE-2026-110872
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...
PT-2026-114186
Name of the Vulnerable Software and Affected Versions Nodemailer versions 3.0.0 through 10.0.9 Description A quadratic complexity denial of service issue exists in the SMTP client reply parser. A malicious SMTP server or an on-path attacker can stream continuation lines without a completion line...
Linux Distros Unpatched Vulnerability : CVE-2026-110872
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData an...
CVE-2026-110872: Uncontrolled Resource Consumption
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...
CVE-2026-15340
A flaw was found in lwIP. The Simple Mail Transfer Protocol SMTP client does not properly validate the size of inputs, leading to a buffer overflow. A malicious SMTP server could use this flaw to crash or possibly execute arbitrary code with the privileges of the SMTP client by sending an...
Linux Distros Unpatched Vulnerability : CVE-2026-15340
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow. CVE-2026-15340 Note that Nessus relies on the presence of the packag...
DEBIAN-CVE-2026-15340
lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow...
CVE-2026-15340
lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow...
CVE-2026-15340
The Savannah lwIP SMTP client (specifically version v2.2.1 ) is vulnerable to a classic buffer overflow because it fails to perform adequate size checks on inputs. This vulnerability could allow an attacker to crash the affected device or achieve remote code execution . Impacted systems are often...
