CVE-2026-114426 Details
Description
SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with concurrent or slow requests, causing service unavailability.
A denial-of-service vulnerability has been identified in SEPPmail Secure Email Gateway versions prior to 15.1.1. The issue arises because the application processes and writes upload data through the v1 file-interface before authenticating the caller and without a strict limit on request size. This allows an unauthenticated remote attacker to disrupt service by occupying worker processes and consuming temporary storage with concurrent or slow requests, leading to service unavailability.
Users can update to SEPPmail Secure Email Gateway version 15.1.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.seppmail.com/en/20_revision-history.html | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SEPPmail Secure Email Gateway | < 15.1.1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | [email protected] |