CVE-2026-108121: Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service

Published Oct 19, 2026

Updated

Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from starting after a server reboot, resulting in a denial-of-service (DoS) condition affecting the web server and its hosted virtual hosts.

Affected Software

1 affected component

Koozali SME Server=11.0rc1-215

Event History

Oct 19, 2026

CVE Published

via MITRE·05:07 AM

Data Sourced

via MITRE·05:07 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires high privileges on the affected SME Server. The attacker uses the domain creation functionality to inject reserved Apache configuration directives.

What is the operational impact after exploitation?

Injected directives can corrupt httpd.conf. After the next server reboot, Apache may fail to start, causing denial of service for the web server and its hosted virtual hosts.

Is the failure immediate?

The described Apache startup failure occurs after a server reboot. Systems that have not rebooted may still have a corrupted configuration that will prevent Apache from starting when rebooted.