CVE-2026-82973
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox…
- Risk score
- 78/100
- CVSS
- 9.4 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or se…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.4.13 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.4 critical
- Remotely exploitable without logging in
- On your watchlist: docker
References
Original description
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.
Last activity 29 Sep 2026. Patch Forecast updates every hour.