CVE-2026-82973

Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox

State: Published
Severity: 9.4 Critical
Published: Sep 29, 2026
Updated: Sep 29, 2026
Reserved: Aug 31, 2026

Description

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.

Scores

CVSS	Score	Vector	Source
3.1	9.4 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H	GitLab

Weaknesses

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

Affected Products

Product	Versions
docker-mailboxpsyb0t	0.1.0 through 0.4.12Affected

References

https://gitlab.com/psyb0t/docker-mailbox/-/commit/90e6b492d42e011d0ba2c825795b33d054ee6636

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.