CVE-2026-82973CWE-93

CVE-2026-82973

Critical · published September 29, 2026

CVSS v3.1
9.4
EPSS
0%
Percentile
35.2
In the wild
Unconfirmed
What it is

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00419 · 35.2th percentile
Weakness
CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-09-29T17:17Z
References (1)
https://gitlab.com/psyb0t/docker-mailbox/-/commit/90e6b492d42e011d0ba2c825795b33d054ee6636 · [email protected]
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 0%
    epss
  • 29 SEP 12:11Z
    Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox
    cvelistv5