CVE-2026-114731
Medium
Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit “Add a size limit to the CSS proxy content processing”, which caps the response at 5 MB, reads it as a stream and applies a read timeout.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Roundcube Webmail
PublishedOct 22, 2026
First seenOct 22, 2026
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- roundcube webmail1.6.20, 1.7.5 or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| roundcube webmail | 1.6.0 ≤ v < 1.6.20, 1.7.0 ≤ v < 1.7.5 | 1.6.20, 1.7.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.