CVE-2026-82973
published 2026-09-29CVE-2026-82973: Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when…
PriorityP266critical9.4CVSS 3.1
AVNACLPRNUINSUCLIHAH
EPSS
0.42%
34.0th percentile
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitlab | docker-mailbox | — | — |
| psyb0t | docker-mailbox | 0.1.0 – 0.4.12 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox
vendor_gitlab·2026-09-29·CVSS 9.4
CVE-2026-82973 [CRITICAL] CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox
Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.
Affected products: docker-mailbox
Affected versions: 0.1.0 (affected)
Solution: Upgrade to version 0.4.13 or later.
Credit: Kietgboiz17 (@kietgboiz17, https://gitlab.com/kietgboiz17)
GHSA
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configur
ghsa_unreviewed·2026-09-29
CVE-2026-82973 [CRITICAL] CWE-93 Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configur
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-29
Published