CVE-2026-114426: Pre-authentication upload parsing permits resource exhaustion
SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with concurrent or slow requests, causing service unavailability.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
SEPPmail Secure Email Gateway versions before 15.1.1 are affected if they accept remote v1 file-interface upload requests. The attack can be performed remotely without authentication.
What does an attacker need to do to cause an impact?
An attacker can send concurrent or slow upload requests with upload data that is processed and written before authentication. Because there is no absolute request-size limit, this can occupy workers and consume temporary storage until service becomes unavailable.
Is user interaction or valid credentials required?
No. The issue is pre-authentication and can be exploited by an unauthenticated remote attacker without user interaction.
How can I determine whether my system is affected?
Check whether the Secure Email Gateway version is earlier than 15.1.1 and whether the v1 file interface is reachable by remote clients. Systems meeting both conditions should be treated as exposed to resource-exhaustion attempts.