CVE-2025-40631: HTTP host header injection vulnerability in IceWarp Mail Server
Published May 16, 2025
·Updated
HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected.
Affected Software
2 affected components
IceWarp Mail Server
IceWarp Mail Server=11.4.0
Remediation
Information
The vulnerabilities have been fixed by the IceWarp team in the 13.0.2 version.
Event History
May 16, 2025
CVE Published
via MITRE·11:09 AM
Data Sourced
via MITRE·11:09 AM
RemedyDescriptionWeakness
Data Sourced
via NVD·11:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-40631?
CVE-2025-40631 is rated as a high severity vulnerability due to its potential for executing arbitrary JavaScript code.
2
How do I fix CVE-2025-40631?
To fix CVE-2025-40631, upgrade Icewarp Mail Server to version 11.4.1 or later to mitigate the vulnerability.
3
What versions of Icewarp Mail Server are affected by CVE-2025-40631?
CVE-2025-40631 affects Icewarp Mail Server version 11.4.0.
4
What kind of attacks can be executed using CVE-2025-40631?
CVE-2025-40631 allows attackers to execute arbitrary JavaScript code through HTTP host header injection.
5
Does CVE-2025-40631 require user interaction to exploit?
Yes, exploiting CVE-2025-40631 requires the user to interact with a malicious link.