CVE-2026-114731

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to an uncontrolled resource consumption vulnerability (CWE-770) within the CSS proxy (utils/modcss action). The root cause is that fetched stylesheets are read into memory in full without a size limit or read timeout, ...

EUVD-2026-107998

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy the utils/modcss action. The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an...