Denial of Service in Roundcube Webmail Due to Infinite Loop in TNEF Decoder
CVE-2026-62642

4.3MEDIUM

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
14 July 2026

What is CVE-2026-62642?

A vulnerability exists in Roundcube Webmail versions prior to 1.6.17 and 1.7.x versions before 1.7.2, where an infinite loop in the TNEF decoder can be triggered. This issue is encountered when a user opens an email containing a TNEF (Transport Neutral Encapsulation Format) attachment, potentially leading to a denial of service. Users are advised to upgrade to the latest versions to mitigate this risk.

Affected Version(s)

Webmail 1.6.0 < 1.6.17

Webmail 1.7.0 < 1.7.2

References

https://roundcube.net/news/2026/07/05/security-updates-1....
https://github.com/roundcube/roundcubemail/releases/tag/1...
https://github.com/roundcube/roundcubemail/commit/877269c...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.