Bug 2558740 (CVE-2026-114726)

Summary: CVE-2026-114726 roundcubemail: roundcubemail: Mail header injection via crafted From display name in bounce action
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Roundcube Webmail. This vulnerability allows a remote attacker to inject arbitrary email headers by sending an email containing encoded carriage return and line feed (CRLF) control characters within the sender display name. When an affected user bounces or resends the message, the application fails to strip these control characters, causing injected headers to be included in the outgoing email and potentially enabling email spoofing or unintended message routing.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2562386, 2562387    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-22 02:11:25 UTC 
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.