Critical severity9.4NVD Advisory· Published Sep 29, 2026· Updated Sep 29, 2026

CVE-2026-82973

Description

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.

Affected products

Psyb0t/docker-mailboxllm-fuzzy
Range: <0.4.13

Patches

Vulnerability mechanics

References

gitlab.com/psyb0t/docker-mailbox/-/commit/90e6b492d42e011d0ba2c825795b33d054ee6636nvd

News mentions

No linked articles in our index yet.

cvss	0.611
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000