CVE-2026-114731 in Roundcube
Summary
by MITRE • 10/23/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit “Add a size limit to the CSS proxy content processing”, which caps the response at 5 MB, reads it as a stream and applies a read timeout.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 represents a critical uncontrolled resource consumption flaw within the CSS proxy functionality, specifically triggered through the utils/modcss action endpoint. This component is designed to fetch external stylesheets referenced by web pages processed by Roundcube, allowing for dynamic styling adjustments based on user preferences or theme configurations. However, the implementation lacked essential safeguards against maliciously crafted requests, creating a significant attack surface that can be exploited by remote attackers without authentication in many default configurations. The core technical flaw lies in how the application handles incoming HTTP responses from external hosts when fetching these stylesheets. Instead of implementing bounded memory allocation or streaming mechanisms with timeouts, the original code read the entire fetched stylesheet content into server-side memory at once. This design decision assumes that all referenced URLs will return reasonably sized and promptly responding resources, an assumption that fails catastrophically under adversarial conditions where the attacker controls the target host.
From a technical perspective, this vulnerability is classified as CWE-400 Uncontrolled Resource Consumption. The absence of a maximum size limit for the response body means that an attacker can direct Roundcube to fetch arbitrarily large files from a server they control. Furthermore, the lack of a read timeout allows the connection to remain open indefinitely if the remote host sends data slowly or stalls after sending initial bytes. This combination enables two distinct denial-of-service vectors: memory exhaustion through massive file downloads and thread/connection pool depletion via slowloris-style attacks that keep connections alive for extended periods without completing them. The operational impact is severe, as successful exploitation can lead to complete service unavailability by consuming all available server memory or exhausting the web server's connection limits, thereby preventing legitimate users from accessing their email accounts. This aligns with ATT&CK technique T1498 Network Denial of Service, specifically sub-techniques related to resource exhaustion via network flooding or slow connections.
The remediation strategy implemented by upstream developers addresses these flaws through a multi-layered defensive approach. The fix introduces a strict size limit that caps the CSS proxy content processing at 5 MB, ensuring that even if an attacker attempts to serve a massive file, only a manageable portion is loaded into memory. Additionally, the implementation was modified to read the response as a stream rather than loading it all at once, which significantly reduces peak memory usage and allows for more efficient resource management during large transfers. Crucially, a read timeout was applied to the network connection, ensuring that if the remote host fails to send data within a specified timeframe, the request is aborted and resources are released back to the pool. These changes collectively mitigate both the memory exhaustion and connection starvation vectors associated with this vulnerability.
To maintain security posture, organizations running Roundcube Webmail must ensure they have upgraded to version 1.6.20 or later for the stable branch, or version 1.7.5 or later for the development branch. For environments where immediate patching is not feasible due to operational constraints, temporary mitigations should include configuring reverse proxies such as Nginx or Apache to enforce strict limits on response sizes and connection timeouts when proxying requests to Roundcube's CSS endpoint. Additionally, restricting outbound network access from the web server to only trusted domains can prevent attackers from leveraging arbitrary external hosts for resource exhaustion attacks. Continuous monitoring of server memory usage and active connections should be implemented to detect potential abuse patterns early, allowing for rapid incident response before service degradation occurs.