Uncontrolled Resource Consumption in Roundcube Webmail by Ikon Technologies

CVE-2026-114731

What is CVE-2026-114731?

Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 are susceptible to a vulnerability that allows attackers to exploit the CSS proxy component. This flaw enables an attacker to submit a stylesheet URL that is controlled by them, allowing the stylesheet to be fully loaded into memory with no size restrictions or timeout settings, resulting in a potential exhaustion of server resources. A patch has been implemented to mitigate this issue, introducing size limits and stream reading capabilities to avoid memory overload.

References