https://vulnerability.circl.lu/sightings/feed 2026-09-30T22:47:17.697837+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/fbd9bc9e-d95b-4098-8322-d0788f3e08dc/export 2026-09-30T22:47:17.726167+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "fbd9bc9e-d95b-4098-8322-d0788f3e08dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61818", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwfpkw6xtt25", "content": "CVE-2026-61818 pg_partman SQL injection in undo_partition() prior to 5.5.0, CVSS 8.5. Unpatched. A partman_user role can inject SQL that runs with the caller's privileges. Patch or restrict partman_user access now. https://www.valtersit.com/cve/CVE-2026-61818/ #CVE #infosec #PostgreSQL", "creation_timestamp": "2026-09-26T07:00:03.870847Z"} 2026-09-26T07:00:03.870847+00:00 https://vulnerability.circl.lu/sighting/a40e142f-9e5f-4f32-badf-c4dbb0e7348a/export 2026-09-30T22:47:17.728485+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a40e142f-9e5f-4f32-badf-c4dbb0e7348a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61818", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117335970277189695", "content": "CVE-2026-61818 pg_partman SQL injection in undo_partition() prior to 5.5.0, CVSS 8.5. Unpatched. A partman_user role can inject SQL that runs with the caller's privileges. Patch or restrict partman_user access now. https://www.valtersit.com/cve/CVE-2026-61818/ #CVE #infosec #PostgreSQL", "creation_timestamp": "2026-09-26T06:40:41.732735Z"} 2026-09-26T06:40:41.732735+00:00 https://vulnerability.circl.lu/sighting/1d4bedb1-e16f-410c-95bd-b56ee7fe8ee1/export 2026-09-30T22:47:17.728644+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1d4bedb1-e16f-410c-95bd-b56ee7fe8ee1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61816", "type": "seen", "source": "https://gist.github.com/alon710/752908b52d1b5f088fc141196f91ca9b", "content": "# CVE-2026-61816: CVE-2026-61816: Uncontrolled Resource Consumption and Algorithmic Complexity in zbateson/mail-mime-parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61816\n\n## Summary\nThe PHP email processing library zbateson/mail-mime-parser is vulnerable to multiple algorithmic complexity exploits. By submitting small, highly structured email payloads, remote, unauthenticated attackers can trigger high CPU utilization or out-of-memory states, causing an application-wide denial of service.\n\n## TL;DR\nA denial of service vulnerability in zbateson/mail-mime-parser allows unauthenticated remote attackers to trigger severe CPU exhaustion or out-of-memory crashes by submitting malformed emails under 2 MB containing deeply nested boundaries, large header lists, or dense sibling attachments.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- zbateson/mail-mime-parser (PHP Package)\n- **mail-mime-parser**: >= 2.0.0, < 3.0.6 (Fixed in: `3.0.6`)\n- **mail-mime-parser**: >= 4.0.0, < 4.0.2 (Fixed in: `4.0.2`)\n\n## Mitigation\n\n- Update zbateson/mail-mime-parser to versions 3.0.6, 4.0.2, or newer.\n- Impose global constraints on memory_limit and max_execution_time within the PHP runtime configuration.\n- Deploy proxy-level or mail-transfer-agent (MTA) validation rules to drop exceptionally deep MIME hierarchies.\n\n**Remediation Steps:**\n1. Run 'composer update zbateson/mail-mime-parser' to download version 3.0.6 or 4.0.2.\n2. Review custom DI container setups to ensure they inherit the default values for 'maxMimePartDepth', 'maxHeaderCount', and 'maxHeaderSizeBytes'.\n3. Set 'memory_limit' to a conservative threshold (e.g. 128M) in php.ini to contain potential OOM outcomes.\n\n## References\n\n- [GHSA-f6v3-2qmr-vfjx: Uncontrolled resource consumption / algorithmic complexity DoS](https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx)\n- [CVE.org CVE-2026-61816 Vulnerability Record](https://www.cve.org/CVERecord?id=CVE-2026-61816)\n- [NVD - CVE-2026-61816 Analysis Dashboard](https://nvd.nist.gov/vuln/detail/CVE-2026-61816)\n- [Primary Configuration Limits and Depth Check Commit](https://github.com/zbateson/mail-mime-parser/commit/1691e695821f70461f9554e9bb71be2859404a24)\n- [Sibling Append Splice Optimization Commit](https://github.com/zbateson/mail-mime-parser/commit/fa44823ba9dd651e0eecec7aa45ac8c8e6afcb78)\n- [Release 3.0.7 GitHub Tag](https://github.com/zbateson/mail-mime-parser/releases/tag/3.0.7)\n- [Release 4.0.2 GitHub Tag](https://github.com/zbateson/mail-mime-parser/releases/tag/4.0.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61816) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T07:30:34.000000Z"} 2026-09-25T07:30:34+00:00 https://vulnerability.circl.lu/sighting/5845c365-6bf3-4357-879b-ee8a9557ffe5/export 2026-09-30T22:47:17.728771+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "5845c365-6bf3-4357-879b-ee8a9557ffe5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61815", "type": "seen", "source": "https://gist.github.com/alon710/702cdfae67a6daa77470a0a110e821f9", "content": "# CVE-2026-61815: CVE-2026-61815: Remote SMTP Header Injection via Unsanitized MIME Decoded Filenames in zbateson/mail-mime-parser\n\n> **CVSS Score:** 7.2\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61815\n\n## Summary\nCVE-2026-61815 is a high-severity Carriage Return / Line Feed (CRLF) header injection vulnerability in the zbateson/mail-mime-parser library. Due to incomplete sanitization logic, encoded newline sequences within filenames and headers survive parsing and translate into literal CRLF control bytes. When applications process or forward these payloads, the library writes the unescaped control bytes directly into outbound SMTP metadata, allowing remote attackers to inject rogue headers or compromise message integrity.\n\n## TL;DR\nA validation error in zbateson/mail-mime-parser allows remote attackers to inject malicious email headers (such as Bcc directives) by embedding encoded CRLF sequences inside attachment filenames. Patches in versions 3.0.6 and 4.0.2 remediate the issue.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-93\n- **Attack Vector**: Network (Remote)\n- **CVSS v3.1 Score**: 7.2\n- **Impact Type**: Header Injection / Email Exfiltration\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Listed**: No\n\n## Affected Systems\n\n- zbateson/mail-mime-parser < 3.0.6\n- zbateson/mail-mime-parser >= 4.0.0, < 4.0.2\n- zbateson/mail-mime-parser 1.x (all versions, End-of-Life)\n- zbateson/mail-mime-parser 2.x (all versions, End-of-Life)\n- **mail-mime-parser**: < 3.0.6 (Fixed in: `3.0.6`)\n- **mail-mime-parser**: >= 4.0.0, < 4.0.2 (Fixed in: `4.0.2`)\n\n## Mitigation\n\n- Upgrade zbateson/mail-mime-parser to 3.0.6, 3.0.7, or 4.0.2 to establish post-decode input validation.\n- Apply localized sanitization on filenames using standard regular expressions prior to passing variables to attachment-handling helper classes.\n- Disable automatic email forwarding or autoresponder mechanisms for attachments derived from untrusted inbound files.\n\n**Remediation Steps:**\n1. Identify the current library version in composer.json under zbateson/mail-mime-parser.\n2. Run 'composer update zbateson/mail-mime-parser' to download and link the patched release.\n3. Audit all custom attachment handlers and introduce structural checks on email attributes.\n4. Validate mail transfer agent (MTA) logs for anomalous headers or unauthorized outbound BCC routing.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-36h5-qg4p-q2qf)\n- [National Vulnerability Database (NVD) Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-61815)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-61815)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61815) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T06:30:32.000000Z"} 2026-09-25T06:30:32+00:00 https://vulnerability.circl.lu/sighting/86706e13-5742-486c-a16f-0d8b2f7a027a/export 2026-09-30T22:47:17.728892+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "86706e13-5742-486c-a16f-0d8b2f7a027a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61817", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwagb4typa2i", "content": "CVE-2026-61817: SQL injection in pg_partman before 5.5.0. A partman_user role can poison part_config and inject SQL through run_maintenance. CVSS 8.5, no patch yet. Restrict that role until 5.5.0 lands. https://www.valtersit.com/cve/CVE-2026-61817/ #CVE #infosec #PostgreSQL", "creation_timestamp": "2026-09-24T04:30:12.475999Z"} 2026-09-24T04:30:12.475999+00:00 https://vulnerability.circl.lu/sighting/c554d565-4b43-4e25-9a73-5ab670776af4/export 2026-09-30T22:47:17.728990+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "c554d565-4b43-4e25-9a73-5ab670776af4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61817", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117324133730193909", "content": "CVE-2026-61817: SQL injection in pg_partman before 5.5.0. A partman_user role can poison part_config and inject SQL through run_maintenance. CVSS 8.5, no patch yet. Restrict that role until 5.5.0 lands. https://www.valtersit.com/cve/CVE-2026-61817/ #CVE #infosec #PostgreSQL", "creation_timestamp": "2026-09-24T04:30:11.166307Z"} 2026-09-24T04:30:11.166307+00:00 https://vulnerability.circl.lu/sighting/5178ed1c-c414-4bef-b9bd-1cf8e6548a1d/export 2026-09-30T22:47:17.729086+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "5178ed1c-c414-4bef-b9bd-1cf8e6548a1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61819", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mw2oxqjurs2p", "content": "CVE-2026-61819 pg_partman SQL injection (CVSS 8.5), unpatched. Parent-table name with a quote can break out of a literal and inject SQL via pg_jobmon exception paths. Upgrade to 5.5.0 or later now. https://www.valtersit.com/cve/CVE-2026-61819/ #CVE #infosec #PostgreSQL", "creation_timestamp": "2026-09-21T21:50:02.280182Z"} 2026-09-21T21:50:02.280182+00:00 https://vulnerability.circl.lu/sighting/af618ede-8051-4c59-90b9-597fe0d78164/export 2026-09-30T22:47:17.729175+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "af618ede-8051-4c59-90b9-597fe0d78164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61819", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117311196424440502", "content": "CVE-2026-61819 pg_partman SQL injection (CVSS 8.5), unpatched. Parent-table name with a quote can break out of a literal and inject SQL via pg_jobmon exception paths. Upgrade to 5.5.0 or later now. https://www.valtersit.com/cve/CVE-2026-61819/ #CVE #infosec #PostgreSQL", "creation_timestamp": "2026-09-21T21:40:02.400962Z"} 2026-09-21T21:40:02.400962+00:00 https://vulnerability.circl.lu/sighting/718e1502-49e2-4fb5-a8c7-fadcc4b66c53/export 2026-09-30T22:47:17.729266+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "718e1502-49e2-4fb5-a8c7-fadcc4b66c53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61819", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvxygxkils2p", "content": "\ud83d\udfe0 CVE-2026-61819 - High (8.5)\n\npg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-61819/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-20T20:01:38.897280Z"} 2026-09-20T20:01:38.897280+00:00 https://vulnerability.circl.lu/sighting/dd851239-37c4-4168-8729-11548d42940e/export 2026-09-30T22:47:17.729358+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "dd851239-37c4-4168-8729-11548d42940e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61818", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvxygpqvmm2b", "content": "\ud83d\udfe0 CVE-2026-61818 - High (8.5)\n\npg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5....\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-61818/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-20T20:01:31.298506Z"} 2026-09-20T20:01:31.298506+00:00