Live › vulnerability › CVE-2026-114731
Go to dashboardThe Roundcube CSS proxy (utils/modcss) loads a remote stylesheet fully into memory with no size limit and no read timeout. An attacker who can point a stylesheet URL at a host they control can exhaust server memory and degrade or crash the webmail service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Roundcube Webmail installation below 1.6.20 or in the 1.7.x line below 1.7.5 is exposed, because the vulnerable utils/modcss action is reached over HTTP by the webmail. Self-hosted mail servers are the main concern. Installations already on a patched release can skip it.
No product ranges from the sources yet.
roundcube version in the installation (CHANGELOG or program/include/iniset.php RCMAIL_VERSION)1.6.20 on the 1.6 branch or 1.7.5 on the 1.7 branchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit “Add a size limit to the CSS proxy content processing”, which caps the response at 5 MB, reads it as a stream and applies a read timeout.
This page as .md · .json · in your agent: get_signal("CVE-2026-114731")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.