Allocation of Resources Without Limits or Throttling in Roundcube Webmail - #VU156139
Published: October 19, 2026
Vulnerability identifier: #VU156139
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause excessive resource consumption and potentially a denial of service.
The vulnerability exists due to a missing content size limit in CSS proxy processing when handling oversized CSS content. A remote attacker can provide excessive CSS content for the proxy to process to consume server resources and potentially disrupt service availability.
Affected software
Roundcube Webmail
Remediation
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.6.20, 1.7.5