CVE-2026-108121CWE-20CWE-400CWE-96denial-of-service

CVE-2026-108121

published October 19, 2026

CVSS
6.9
EPSS
0%
Percentile
22.5
In the wild
Unconfirmed
What it is

Brian Mariani from DigitalCanion SA has discovered a  vulnerability in the domain creation functionality of koozali's

SME Server version 11.0rc1-215, allowing an attacker with high privileges

to inject reserved Apache configuration directives, corrupting

httpd.conf and preventing Apache from starting after a server reboot,

resulting in a denial-of-service (DoS) condition affecting the web

server and its hosted virtual hosts.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:P/S:P/AU:Y/R:A/RE:M/U:Amber
EPSS
0.00309 · 22.5th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-400 · Uncontrolled Resource Consumption; CWE-96 · Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
Published
2026-10-19T10:17Z
References (1)
https://digitalcanion.com/en/security-research/#vendor=koozali · [email protected]
EPSS history
Timeline
  • 20 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 19 OCT 05:07Z
    Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service
    cvelistv5
  • 19 OCT 05:07Z
    Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service
    cvelistv5