CVE-2026-62642 Denial of service in Webmail
An attacker can cause a denial of service by sending an email with a malicious TNEF attachment, affecting Roundcube Webmail users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-62642?
CVE-2026-62642 is a medium-severity denial of service vulnerability in Roundcube Webmail, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.
Weakness: CWE-835
Which versions are affected by CVE-2026-62642?
It affects 1 product.
Products include Roundcube Webmail.
How do I fix CVE-2026-62642?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-62642 being exploited?
There is no known exploitation of CVE-2026-62642 in the wild and no public exploit code.
Other vulnerabilities in Roundcube Webmail
Sources
Also known as DEBIAN-CVE-2026-62642, GHSA-345h-r9m2-jr4p, UBUNTU-CVE-2026-62642.