CVE-2026-114726 | Roundcube Webmail up to 1.6.19/1.7.4 Bounce Action decode_address_list crlf injection

October 22, 2026 Yanac

A vulnerability, which was classified as problematic, has been found in Roundcube Webmail up to 1.6.19/1.7.4. Impacted is the function rcube_mime::decode_address_list of the component Bounce Action. The manipulation leads to crlf injection.

This vulnerability is documented as CVE-2026-114726. The attack can be initiated remotely. There is not any exploit available.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More