HTTP Host Header Injection in Icewarp Mail Server

CVE-2025-40631

What is CVE-2025-40631?

The Icewarp Mail Server is susceptible to an HTTP host header injection vulnerability. By manipulating the Host header to include a malicious payload, attackers can execute arbitrary JavaScript code upon page load. This exploitation requires user interaction with a malicious link, potentially compromising the security of the user's session and sensitive information.

References