CVE-2026-62642

Katalog CVE

CVSS 6.5 · Medium EPSS 0,52%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada roundcube webmail. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

20 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2 advisory vendor
• https://github.com/roundcube/roundcubemail/commit/132ac8dd5a55c8466be12de1daf84355697ffa89 patch
• https://github.com/roundcube/roundcubemail/commit/877269c79359d959a94f13c9070cab0f3389c193 patch
• https://github.com/roundcube/roundcubemail/commit/a007321346380136b3de2bd75b486b04f63c0d38 patch
• https://github.com/roundcube/roundcubemail/commit/fb952956c6eaf29e963f1a718d028d66e7957ce0 patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.17 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.2 release notes