CVE-2026-41873 Details
Description
** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin account takeover. This issue affects all versions of the Lua implementation of Pony Mail. There is a Python implementation under development under the name "Pony Mail Foal" that is not affected by this issue, but hasn't been released yet. As the Lua implementation of this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
A vulnerability allowing admin account takeover via HTTP request/response smuggling has been identified in Pony Mail's Lua implementation, affecting all versions. This vulnerability arises from an inconsistent interpretation of HTTP requests, which can be exploited to manipulate request handling and potentially gain unauthorized administrative access. While a Python implementation called 'Pony Mail Foal' is in development and not affected by this issue, it has not yet been released. Users of the Lua version are advised to seek alternatives or limit access to trusted users, as this version is no longer supported by the maintainer.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/04/28/17 | CVE | |
| https://lists.apache.org/thread/1c7jtxjobh280kqc13fzw1cg57xrz951 | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache pony mail | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | CVE Modified | CVE |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 28, 2026 | New CVE Received | [email protected] |