Live › vulnerability › CVE-2026-119762
Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40 and 10.7.x before 10.7.2 fails to limit how deeply nested SOAP/XML and JSON request bodies can be before login. A single deeply nested request to the WebMail, WebAdmin or WebMail Proxy listeners exhausts the stack and crashes SMTP, IMAP, POP3 and web services, and it can be repeated.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Any organisation running Axigen Mail Server with WebMail, WebAdmin or WebMail Proxy listeners exposed to the network is affected, since the request is parsed before authentication. Servers that only accept mail over SMTP or IMAP without the web listeners exposed are less likely to be reached this way, though the sources do not say this explicitly.
No product ranges from the sources yet.
10.5.69, 10.6.40 or 10.7.2 on its branch is in the stated range.10.5.69 or later on the 10.5 branch10.6.40 or later on the 10.6 branch10.7.2 or later on the 10.7 branchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.
This page as .md · .json · in your agent: get_signal("CVE-2026-119762")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.