CVE-2026-40193 Details
Description
maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any LDAP filter escaping, despite the go-ldap/ldap/v3 library's ldap.EscapeFilter() function being available in the same import. This affects three code paths: the Lookup() filter, the AuthPlain() DN template, and the AuthPlain() filter. An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands. This enables identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration via wildcard filters, and blind extraction of LDAP attribute values using authentication responses as a boolean oracle or via timing side-channels between the two distinct failure paths. This issue has been fixed in version 0.9.3.
A vulnerability allowing LDAP injection has been identified in the Maddy mail server, specifically in versions prior to 0.9.3. The issue arises in the auth.ldap module, where user-supplied usernames are directly inserted into LDAP search filters and DN strings without proper escaping. This flaw allows an attacker with network access to the SMTP submission or IMAP interface to inject arbitrary LDAP filter expressions, leading to identity spoofing, unauthorized LDAP directory enumeration, and extraction of LDAP attribute values through authentication response manipulation.
Users are advised to upgrade to Maddy version 0.9.3, which addresses the LDAP injection vulnerability by implementing proper escaping when constructing LDAP filters and DN strings.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba | [email protected] | Patch |
| https://github.com/foxcpp/maddy/releases/tag/v0.9.3 | [email protected] | ProductRelease Notes |
| https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-90 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| maddy project maddy | < 0.9.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 16, 2026 | New CVE Received | [email protected] |