CVE-2026-40012

MediumCVSS 5.3/10Last modified Jun 25, 2026

Description

ECS zero scoped answers are stored in the packet cache while they should not. This impacts only configurations that have ECS enabled;

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-524

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2026
Last modified
Jun 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-400134.3An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write CVE-2026-400146.5An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the sCVE-2026-400154.3An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermitCVE-2026-400166.5Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 CVE-2026-400176.5An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makeCVE-2026-400187.4None None None No publicly available exploits are known.CVE-2026-400195.9An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop cCVE-2026-40024.3The Petje.af plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.1.8. This is due to missCVE-2026-400204.3Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This cCVE-2026-400215.3Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J httpCVE-2026-400228.2When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-rCVE-2026-400235.3Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails
CVE-2026-40012: Medium severity, CVSS 5.3 | Vulnix