CVE-2026-114726 in Roundcube
Summary
by MITRE • 10/22/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified as CVE-2024-31987 represents a critical security flaw within Roundcube Webmail, specifically affecting versions prior to 1.6.20 and version series 1.7.x before the release of 1.7.5. This issue is classified under Common Weakness Enumeration (CWE) as CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, commonly known as injection vulnerabilities. More specifically, it aligns with CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection'), which allows attackers to inject arbitrary text into HTTP headers or email message structures. The attack vector is rooted in the application's handling of encoded MIME data during the bounce or resend functionality, a feature that allows users to forward received messages while preserving certain metadata and formatting.
The technical root cause lies within the rcube_mime::decode_address_list() function, which is responsible for parsing and decoding email address fields from incoming messages. When processing the From header field, specifically the display name portion of an encoded word, the application failed to adequately sanitize or strip control characters such as carriage return (CR) and line feed (LF). In standard MIME encoding schemes like RFC 2047, special characters are often represented using specific encoding patterns that can be misinterpreted by downstream parsers if not handled with strict validation. By allowing CRLF sequences embedded within an encoded display name to pass through without neutralization, the application inadvertently permits these control characters to terminate existing header lines and introduce new ones into the outgoing message structure.
From a operational perspective, this flaw enables a malicious actor who has access to Roundcube Webmail to perform mail header injection attacks against other recipients. An attacker can craft a specially formatted email where the sender's display name contains hidden CRLF sequences encoded in MIME format. When another user within the same organization or system uses the bounce feature to forward this message, the injected control characters cause the resulting forwarded email to contain arbitrary headers added by the attacker. This capability is particularly dangerous because it allows for phishing attacks via header spoofing, where the forged headers can make the maliciously modified email appear as if it originates from a trusted source or target specific internal systems based on manipulated routing information.
This vulnerability maps directly to MITRE ATT&CK technique T1568.002, Dynamic Resolution Techniques: Domain Fronting, and more broadly to T1534 Internal Spearphishing, as the attacker leverages legitimate email infrastructure to deceive recipients. The ability to inject headers facilitates social engineering attacks by altering perceived sender identities or routing paths, thereby increasing the likelihood of successful credential harvesting or malware delivery within an organization that relies on Roundcube for internal communications.
Mitigation strategies primarily involve upgrading the Roundcube installation to version 1.6.20 or later, which includes the upstream fix referenced in commit messages addressing this specific header injection vector. The patch ensures that control characters are properly stripped from decoded display names before they are processed during message transmission. In environments where immediate upgrade is not feasible, administrators should implement strict input validation at the web server level to filter out CRLF sequences in email headers and consider disabling the bounce feature if it is not essential for business operations. Additionally, deploying email security gateways that inspect outgoing messages for anomalous header structures can provide an additional layer of defense against exploitation attempts targeting this specific weakness.