Sender Spoofing Vulnerability in postal-mime by PostalSys

CVE-2026-125756

What is CVE-2026-125756?

The postal-mime library, prior to version 4.2.1, exhibits a vulnerability in its address parsing functionality. This flaw allows a remote attacker to exploit the system by crafting deceptive From headers. The vulnerability arises from the truncation of domain names occurring at folding whitespace or comments preceding a dot, leading to potential sender address spoofing. As a consequence, attackers might bypass email authentication checks like SPF, DKIM, and DMARC, enabling them to impersonate a victim and facilitate fraudulent activities.

References