{"id":"CVE-2026-119762","kind":"vulnerability","aliases":["CVE-2026-119762"],"related":[],"title":"Axigen Mail Server: one crafted web request crashes all mail services","description":"Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.","summary":"Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40 and 10.7.x before 10.7.2 fails to limit how deeply nested SOAP/XML and JSON request bodies can be before login. A single deeply nested request to the WebMail, WebAdmin or WebMail Proxy listeners exhausts the stack and crashes SMTP, IMAP, POP3 and web services, and it can be repeated.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["axigen","mail-server","other","self-hosted","webmail"],"not_affected_if":["versions-patched","web-listeners-not-exposed"],"how_to_check":"- Check the installed Axigen version in the WebAdmin interface or the server package.\n- Confirm whether WebMail, WebAdmin or WebMail Proxy listeners are reachable from the internet.\n- Any version below `10.5.69`, `10.6.40` or `10.7.2` on its branch is in the stated range.","fix":"- Axigen Mail Server `10.5.69` or later on the 10.5 branch\n- Axigen Mail Server `10.6.40` or later on the 10.6 branch\n- Axigen Mail Server `10.7.2` or later on the 10.7 branch","status":"open","published_at":"2026-10-30T18:17:26+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","triaged_at":"2026-10-30T18:56:45+00:00","updated_at":"2026-10-30T18:56:45+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-30T18:56:45Z","model":"claude-haiku-5-5","output":{"fix":"- Axigen Mail Server `10.5.69` or later on the 10.5 branch\n- Axigen Mail Server `10.6.40` or later on the 10.6 branch\n- Axigen Mail Server `10.7.2` or later on the 10.7 branch","reach":"internet","title":"Axigen Mail Server: one crafted web request crashes all mail services","impact":"medium","summary":"Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40 and 10.7.x before 10.7.2 fails to limit how deeply nested SOAP/XML and JSON request bodies can be before login. A single deeply nested request to the WebMail, WebAdmin or WebMail Proxy listeners exhausts the stack and crashes SMTP, IMAP, POP3 and web services, and it can be repeated.","audience":"businesses","category":"other","nicknames":[],"who_cares":["axigen","mail-server","webmail","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Repeated crashes take down mail and web services until restarted","analyst_note":"","how_to_check":"- Check the installed Axigen version in the WebAdmin interface or the server package.\n- Confirm whether WebMail, WebAdmin or WebMail Proxy listeners are reachable from the internet.\n- Any version below `10.5.69`, `10.6.40` or `10.7.2` on its branch is in the stated range.","plain_action":"","needs_analyst":false,"not_affected_if":["versions-patched","web-listeners-not-exposed"],"who_is_affected":"Any organisation running Axigen Mail Server with WebMail, WebAdmin or WebMail Proxy listeners exposed to the network is affected, since the request is parsed before authentication. Servers that only accept mail over SMTP or IMAP without the web listeners exposed are less likely to be reached this way, though the sources do not say this explicitly.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000778,"input_tokens":4216,"output_tokens":712,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119762':14A,17A '-2026':13A,16A '10.5.69':31B,89C '10.6':32B,90C '10.6.40':35B,93C '10.7':37B,95C '10.7.2':40B,98C 'attack':120C 'authent':119C 'axigen':1A,18B,27B,85C 'bodi':51B,117C 'caus':106C 'contain':99C 'craft':5A 'crash':8A,73B,140C 'cve':12A,15A 'deepli':45B,58B,125C 'denial':102C 'depth':110C 'exhaust':69B,136C 'fail':41B 'host':25B 'imap':75B,142C 'json':49B,115C 'limit':43B 'listen':68B,134C 'login':55B 'mail':2A,10A,20B,28B,86C 'mail-serv':19B 'nest':46B,59B,109C,126C 'one':4A 'pars':112C 'pop3':76B,143C 'proxi':67B,133C 'repeat':84B,147C 'request':7A,50B,60B,116C,127C 'self':24B 'self-host':23B 'send':122C 'server':3A,21B,29B,87C 'servic':11A,79B,104C,146C 'singl':57B,124C 'smtp':74B,141C 'soap/xml':47B,113C 'stack':71B,138C 'unauthent':101C 'unbound':108C 'vulner':105C 'web':6A,78B,145C 'webadmin':64B,130C 'webmail':26B,63B,66B,129C,132C 'x':33B,38B,91C,96C","nicknames":[],"mitigations":[],"who_affected":"Any organisation running Axigen Mail Server with WebMail, WebAdmin or WebMail Proxy listeners exposed to the network is affected, since the request is parsed before authentication. Servers that only accept mail over SMTP or IMAP without the web listeners exposed are less likely to be reached this way, though the sources do not say this explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119762","severity":null,"published_at":"2026-10-30T18:17:26+00:00","modified_at":"2026-10-30T18:17:26+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","fetched_at":"2026-10-30T18:55:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}