How severe is CVE-2026-82973?

CVE-2026-82973 has a CVSS 3.x base score of 9.4, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability high.

Is CVE-2026-82973 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-82973?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2026-82973 published?

CVE-2026-82973 was published on 2026-09-29.

CVE-2026-82973

CVE-2026-82973 is a critical-severity vulnerability with a CVSS 3.x base score of 9.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-93.

Key facts

Severity: Critical (CVSS 3.x base score 9.4)
EPSS exploit prediction: 0% (34th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-93
Published: 2026-09-29
Last modified: 2026-09-29

Description

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.

Frequently asked questions

What is CVE-2026-82973?: Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.
How severe is CVE-2026-82973?: CVE-2026-82973 has a CVSS 3.x base score of 9.4, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability high.
Is CVE-2026-82973 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-82973?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2026-82973 published?: CVE-2026-82973 was published on 2026-09-29.

References

https://gitlab.com/psyb0t/docker-mailbox/-/commit/90e6b492d42e011d0ba2c825795b33d054ee6636

Other CWE-93 (CRLF Injection) vulnerabilities

CVE-2026-77550 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability…
CVE-2024-51501 — Critical (CVSS 10.0): Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit…
CVE-2026-100717 — Critical (CVSS 9.9): froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return…
CVE-2026-90937 — Critical (CVSS 9.9): froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated…
CVE-2026-70615 — Critical (CVSS 9.9): boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users…
CVE-2026-45372 — Critical (CVSS 9.9): cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's…

Browse all CWE-93 (CRLF Injection) vulnerabilities →