CLEANSTART-2026-HW48485 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

CVE-2026-42504 affects multiple packages. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

CLEANSTART-2026-HB54446 HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service

Security vulnerability affects the traefik-fips package. HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service...

CLEANSTART-2026-UQ27206 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

CVE-2026-42504 affects multiple packages. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

CLEANSTART-2024-IN38821 HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service

Security vulnerability affects the go package. HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service...

CLEANSTART-2026-UN12422 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

CVE-2026-42504 affects multiple packages. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

CLEANSTART-2026-MR33736 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

CVE-2026-42504 affects multiple packages. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...

CLEANSTART-2026-KQ20007 HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service

Security vulnerability affects the traefik package. HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service...

CVE-2026-119415

CakePHP versions through 5.4.3 are vulnerable to a MIME header injection flaw within the FormDataPart component. The root cause is the insufficient sanitization of Content-Type and Content-ID values, which allows attackers to inject CR/LF sequences . This vulnerability can be triggered when provi...

CVE-2026-119415 CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments or...

CVE-2026-119415 CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments or...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-114717

A flaw was found in roundcubemail. When forwarding an email as an attachment, the application uses the original message's subject line directly to construct the attachment name without properly sanitizing line breaks. A remote attacker can exploit this vulnerability by sending an email containing...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-66911: Synacor Zimbra Collaboration: Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments

Zimbra is vulnerable to stored cross-site scripting XSS via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when...

Synacor Zimbra Collaboration cross-site scripting vulnerability

Versions of Synacor Zimbra Collaboration prior to 10.1.21 contain a cross-site scripting vulnerability. This flaw arises because the Content-Location MIME header in email attachments is not properly sanitized. Attackers can set this header to javascript: URI, potentially leading to stored...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...