Email with special content can lead to DoS

published 2026-06-01 5 mo ago modified 2026-07-22 3 mo ago also EUVD-2026-33553

cvss: 5.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits: 0; none known

An uncontrolled allocation of resources without limits or throttling in the e-mail handling in OTRS allows excessive allocation which may lead to the abortion of the webserver.This issue affects OTRS:

* 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.4.X

Please note that ((OTRS)) Community Edition 6.x, OTRS 7.x and products based on the ((OTRS)) Community Edition also very likely to be affected

Patch / fix

fixed in 1

otrs otrs 2026.4.1

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 5 mo ago (2026-06-01)

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Affected products

OTRS AG OTRS
OTRS AG ((OTRS)) Community Edition

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-770 Allocation of Resources Without Limits or Throttling

References

otrs.com /release-notes/otrs-security-advisory-2026-06/
vendor-advisory

Sources

CVE List CVE-2026-48187
NVD CVE-2026-48187

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary