CVE-2026-102471

A flaw was found in vertx-mail-client. This vulnerability allows an unauthenticated remote attacker to inject arbitrary email headers and manipulate outgoing messages by submitting unsanitized Carriage Return CR and Line Feed LF characters into email fields or attachment metadata. Consequently, a...

CVE-2026-102471

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the vertx-mail-client does not sanitize CR \r or LF \n characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value...

EUVD-2026-101577

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the vertx-mail-client does not sanitize CR \r or LF \n characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value...

CVE-2026-102471

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the vertx-mail-client does not sanitize CR \r or LF \n characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value...

CVE-2026-102471 CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the vertx-mail-client does not sanitize CR \r or LF \n characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value...

CVE-2026-102471 CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the vertx-mail-client does not sanitize CR \r or LF \n characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value...

br.com.seedgrid:seedgrid-ai-pricing (>=2026.10.08, <=2026.10.22), br.com.seedgrid:seedgrid-apikeys (>=2026.07.08, <=2026.10.22) +56 more potentially affected by CVE-2026-102471 via io.vertx:vertx-mail-client (>=4.0.0, <=4.5.34)

io.vertx:vertx-mail-client MAVEN version =4.0.0, =2026.10.08, =2026.07.08, =2026.07.08, =2026.07.08, =2026.07.08, =2026.09.10, =2026.09.10, =2026.10.08, =2026.09.10, =2026.09.10, =2026.10.08, =2026.07.09, =2026.07.09, =2026.10.08, =2026.10.22 and more Source cves: CVE-2026-102471 Source advisory:...

CVE-2026-102471 CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the vertx-mail-client does not sanitize CR \r or LF \n characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value...

CVE-2026-102471

The io.vertx:vertx-mail-client component in Eclipse Vert.x versions [4.0.0, 4.5.34] , [5.0.0, 5.0.12] , [5.1.0, 5.1.9] , and [5.2.0, 5.2.0] is vulnerable to CRLF header injection . The root cause is the failure to sanitize CR () and LF () characters in user-supplied email header names, values, an...

PT-2026-113938

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the vertx-mail-client does not sanitize CR r or LF characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value passed...

CVE-2026-102471: Improper Neutralization of CRLF Sequences

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the vertx-mail-client does not sanitize CR \r or LF \n characters in user-supplied email header names and values before writing them into the SMTP DATA section. A CR/LF sequence embedded in a name or value...

[SECURITY] Fedora 45 Update: evolution-rspam-0.6.0-67.fc45

Rspam Evolution Plugin enables Evolution Mail client to report email messages as spam to checksum-based and statistical filtering networks. It supports Razor network, DCC, SpamCop and Pyzor. This plugins requires a pretty new version of evolution to build. See README for more information about...

UBUNTU-CVE-2026-82661

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822...

CVE-2026-82661 Nodemailer CRLF Injection via List-* Header Comments

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822...

CVE-2026-82661 Nodemailer CRLF Injection via List-* Header Comments

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822...

CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

CVE-2026-40014

An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor...

CVE-2026-65053 Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

KLA91169 Multiple vulnerabilities in Mozilla Thunderbird ESR

Multiple vulnerabilities were found in Mozilla Thunderbird ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Denial of service...

Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SMTP client System.Net.Mail. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A spoofing vulnerability exis...