CVE-2026-42392

MediumCVSS 4.3/10Last modified Sep 3, 2026

Description

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH functionality. Update to non-vulnerable version. No publicly available exploits are known.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Aug 28, 2026
Last modified
Sep 3, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-423933.1The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attCVE-2026-423954.3A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following logCVE-2026-423966.5Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to FailCVE-2026-423976.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130CVE-2026-423987.7Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-confiCVE-2026-423996.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated lCVE-2026-42407.5A vulnerability was determined in Open5GS up to 2.7.6. The affected element is the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b_aaa_cb/smf_sCVE-2026-424006.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated uCVE-2026-424015.4Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access tCVE-2026-424027.5Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-PolicCVE-2026-424037.5Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy referenCVE-2026-424047.2Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When