CVE-2026-39971 Serendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOST
Attackers can inject SMTP headers via Host header manipulation in Serendipity, enabling email spoofing and reply hijacking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39971?
CVE-2026-39971 is a high-severity vulnerability in S9y Serendipity, published on 14 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header without validation, and the existing sanitization function serendipity_isResponseClean() is not called on HTTP_HOST before embedding it. An attacker who can control the Host header during an email-triggering action such as comment notifications or subscription emails can inject arbitrary SMTP headers into outgoing emails. This enables identity spoofing, reply hijacking via manipulated Message-ID threading, and email reputation abuse through the attacker's domain being embedded in legitimate mail headers. This issue has been fixed in version 2.6.0.
Weakness: CWE-113
Which versions are affected by CVE-2026-39971?
2 open source packages ship an affected version, including s9y/serendipity. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
s9y/serendipity Packagist | All versions | 2.6.0 |
s9y/serendipity Packagist | All versions | 2.6.0 |
Products include S9y Serendipity.
How do I fix CVE-2026-39971?
Upgrade s9y/serendipity to 2.6.0 or later.
Is CVE-2026-39971 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39971 exists.
Other vulnerabilities in S9y Serendipity
Sources
Also known as GHSA-458g-q4fh-mj6r.