{"id":"CVE-2026-114731","kind":"vulnerability","aliases":["CVE-2026-114731"],"related":[],"title":"Roundcube Webmail: CSS proxy reads unlimited remote stylesheets, exhausting server memory","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit “Add a size limit to the CSS proxy content processing”, which caps the response at 5 MB, reads it as a stream and applies a read timeout.","summary":"The Roundcube CSS proxy (utils/modcss) loads a remote stylesheet fully into memory with no size limit and no read timeout. An attacker who can point a stylesheet URL at a host they control can exhaust server memory and degrade or crash the webmail service.","severity":"medium","cvss":5.3,"epss":0.00431,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mail-server","package","roundcube","self-hosted"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed version: `roundcube` version in the installation (CHANGELOG or `program/include/iniset.php` RCMAIL_VERSION)\n- Confirm the CSS proxy is reachable: unknown whether it is on by default","fix":"- Upgrade Roundcube Webmail to `1.6.20` on the 1.6 branch or `1.7.5` on the 1.7 branch\n- Upstream fix: commit 'Add a size limit to the CSS proxy content processing' (5 MB cap, streamed read, read timeout)","status":"open","published_at":"2026-10-22T03:16:38+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:34+00:00","updated_at":"2026-10-25T04:20:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:20:34Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Roundcube Webmail to `1.6.20` on the 1.6 branch or `1.7.5` on the 1.7 branch\n- Upstream fix: commit 'Add a size limit to the CSS proxy content processing' (5 MB cap, streamed read, read timeout)","reach":"internet","title":"Roundcube Webmail: CSS proxy reads unlimited remote stylesheets, exhausting server memory","impact":"low","summary":"The Roundcube CSS proxy (utils/modcss) loads a remote stylesheet fully into memory with no size limit and no read timeout. An attacker who can point a stylesheet URL at a host they control can exhaust server memory and degrade or crash the webmail service.","category":"package","nicknames":[],"who_cares":["roundcube","self-hosted","mail-server"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Webmail server memory exhausted, causing denial of service","analyst_note":"","how_to_check":"- Check the installed version: `roundcube` version in the installation (CHANGELOG or `program/include/iniset.php` RCMAIL_VERSION)\n- Confirm the CSS proxy is reachable: unknown whether it is on by default","needs_analyst":false,"not_affected_if":["patched-version"],"who_is_affected":"Any Roundcube Webmail installation below 1.6.20 or in the 1.7.x line below 1.7.5 is exposed, because the vulnerable utils/modcss action is reached over HTTP by the webmail. Self-hosted mail servers are the main concern. Installations already on a patched release can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3462,"output_tokens":606,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114731':14A,17A '-2026':13A,16A '1.6.20':73C '1.7':75C '1.7.5':78C '5':149C 'action':93C 'add':134C 'affect':80C 'appli':157C 'attack':47B,118C 'attacker-control':117C 'cap':145C 'commit':133C 'consumpt':85C 'content':142C 'control':58B,119C 'could':121C 'crash':66B 'css':3A,28B,89C,140C 'cve':12A,15A 'degrad':64B 'exhaust':9A,60B,125C 'fetch':95C 'fix':129C 'full':102C 'fulli':35B 'host':25B,56B,120C 'limit':41B,106C,137C 'load':31B 'mail':19B 'mail-serv':18B 'mb':150C 'memori':11A,37B,62B,100C,127C 'packag':21B 'point':50B 'process':143C 'proxi':4A,29B,90C,141C 'read':5A,44B,98C,109C,151C,159C 'referenc':115C 'remot':7A,33B 'resourc':84C 'respons':147C 'roundcub':1A,22B,27B,70C 'self':24B 'self-host':23B 'server':10A,20B,61B,126C 'servic':69B 'size':40B,105C,136C 'stream':155C 'stylesheet':8A,34B,52B,96C,113C 'timeout':45B,110C,160C 'uncontrol':83C 'unlimit':6A 'upstream':128C 'url':53B,114C 'use':123C 'utils/modcss':30B,92C 'vulner':86C 'webmail':2A,68B,71C 'x':76C","nicknames":[],"mitigations":[],"who_affected":"Any Roundcube Webmail installation below 1.6.20 or in the 1.7.x line below 1.7.5 is exposed, because the vulnerable utils/modcss action is reached over HTTP by the webmail. Self-hosted mail servers are the main concern. Installations already on a patched release can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T03:16:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114731","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114731","severity":null,"published_at":"2026-10-22T03:16:38+00:00","modified_at":"2026-10-22T16:45:49+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114731","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114731","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}