CVE-2026-125756

postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments…

postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote attackers can craft From headers that pass SPF/DKIM/DMARC alignment for their own subdomain while PostalMime.parse() reports a spoofed victim sender address.

10. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-125756