CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (t

What is CVE-2026-114731?

CVE-2026-114731 is a medium-severity vulnerability in Roundcube Webmail, published on 22 Oct 2026.

Official description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host could be used to exhaust server memory. Upstream fixed this in the commit “Add a size limit to the CSS proxy content processing”, which caps the response at 5 MB, reads it as a stream and applies a read timeout.

Weakness: CWE-770

Which versions are affected by CVE-2026-114731?

How do I fix CVE-2026-114731?

Upgrade to a fixed version.

Is CVE-2026-114731 being exploited?

There is no known exploitation of CVE-2026-114731 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-114731, GHSA-mpw2-q5qr-3w4j, UBUNTU-CVE-2026-114731.