CVE-2026-119762 Details
Description
Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.
A denial-of-service vulnerability has been identified in Axigen Mail Server versions prior to 10.5.69, 10.6.x prior to 10.6.40, and 10.7.x prior to 10.7.2. The vulnerability arises from unbounded nesting depth in the parsing of SOAP/XML and JSON request bodies, before authentication. This flaw allows unauthenticated remote attackers to send deeply nested requests to WebMail, WebAdmin, or WebMail Proxy listeners, exhausting the stack and causing a crash. The resulting segmentation fault terminates the server process, disrupting all associated services (SMTP, IMAP, POP3, and web services) until the process is manually restarted. Repeatedly sending the nested requests can keep the server unavailable.
Users can update to Axigen Mail Server versions 10.5.69, 10.6.40, or 10.7.2, where this vulnerability has been fixed. Instructions for updating are available on the Axigen website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.axigen.com/kb/show/412 | [email protected] | AdvisoryRemedyVendor |
| https://www.axigen.com/updates/axigen-10.6.40 | [email protected] | Release NotesVendor |
| https://www.axigen.com/updates/axigen-10.7.2 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/axigen-mail-server-before-10.5.69-10.6.40-and-10.7.2-unauthenticated-dos-via-nested-requests | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Axigen | >= 10.0.0, < 10.5.69 (semver) >= 10.6.0, < 10.6.40 (semver) >= 10.7.0, < 10.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |