critical9.4
CVE-2026-82973
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when be…
Impact
Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.
Affected products
| Product | Affected versions |
|---|---|
| Psyb0t/Docker-Mailbox | before 0.4.13 |
Versions were read from the advisory text. No structured product data has been published for this record yet.