Search

Find a vulnerability

Search criteria

    4 vulnerabilities by postalsys

    CVE-2026-124016 (GCVE-0-2026-124016)

    Vulnerability from nvd – Published: 2026-11-10 19:22 – Updated: 2026-11-10 21:03 X_Open Source
    VLAI
    Title
    postal-mime < 4.2.1 Algorithmic Complexity DoS via processLine
    Summary
    postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email messages with boundary lines sharing long prefixes with open boundaries. Attackers can deliver a malicious email with nesting up to the default maxNestingDepth of 256, causing per-line parsing cost to scale as O(depth x shared prefix length) and blocking the Node.js event loop for seconds per message.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-10 21:02 UTC
    CWE
    • CWE-407 - Inefficient Algorithmic Complexity
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 8174 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    postalsys postal-mime Affected: 0 , < 4.2.1 (semver)
    		Create a notification for this product.
    Date Public
    2026-11-10 00:00
    Credits
    Arjun Jain
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-124016",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T21:02:59.254959Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T21:03:45.609Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/postalsys/postal-mime/security/advisories/GHSA-q8wm-54mj-r36p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/postal-mime",
          "product": "postal-mime",
          "repo": "https://github.com/postalsys/postal-mime",
          "vendor": "postalsys",
          "versions": [
            {
              "lessThan": "4.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Arjun Jain"
        }
      ],
      "datePublic": "2026-11-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email messages with boundary lines sharing long prefixes with open boundaries. Attackers can deliver a malicious email with nesting up to the default maxNestingDepth of 256, causing per-line parsing cost to scale as O(depth x shared prefix length) and blocking the Node.js event loop for seconds per message."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T19:22:30.485Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-q8wm-54mj-r36p)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/postalsys/postal-mime/security/advisories/GHSA-q8wm-54mj-r36p"
        },
        {
          "name": "Fixed Release Tag",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/postalsys/postal-mime/releases/tag/v4.2.1"
        },
        {
          "name": "VulnCheck Advisory: postal-mime \u003c 4.2.1 Algorithmic Complexity DoS via processLine",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/postal-mime-algorithmic-complexity-dos-via-processline"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "postal-mime \u003c 4.2.1 Algorithmic Complexity DoS via processLine",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124016",
    "datePublished": "2026-11-10T19:22:30.485Z",
    "dateReserved": "2026-11-06T18:38:38.544Z",
    "dateUpdated": "2026-11-10T21:03:45.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-125756 (GCVE-0-2026-125756)

    Vulnerability from nvd – Published: 2026-11-10 15:22 – Updated: 2026-11-10 19:04
    VLAI
    Title
    postal-mime before 4.2.1 Sender Spoofing via Address Parser Domain Truncation
    Summary
    postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote attackers can craft From headers that pass SPF/DKIM/DMARC alignment for their own subdomain while PostalMime.parse() reports a spoofed victim sender address.
    Severity
    8.2 (High)
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
    5.9 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-10 18:19 UTC
    CWE
    • CWE-436 - Interpretation Conflict
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 8174 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    postalsys postal-mime Affected: 0 , < 4.2.1 (semver)
    		Create a notification for this product.
    Date Public
    2026-11-10 00:00
    Credits
    Ismail Can Guner
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125756",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T18:19:10.589120Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T19:04:25.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/postal-mime",
          "product": "postal-mime",
          "vendor": "postalsys",
          "versions": [
            {
              "lessThan": "4.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ismail Can Guner"
        }
      ],
      "datePublic": "2026-11-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote attackers can craft From headers that pass SPF/DKIM/DMARC alignment for their own subdomain while PostalMime.parse() reports a spoofed victim sender address."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T15:22:50.822Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-jh3p-792r-98gm)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/postalsys/postal-mime/security/advisories/GHSA-jh3p-792r-98gm"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/postalsys/postal-mime/commit/646725704463839f233472453b7c8306bd1dde21"
        },
        {
          "name": "postal-mime v4.2.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/postalsys/postal-mime/releases/tag/v4.2.1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/postalsys/postal-mime/blob/939a220bd518f54d98a088c315d7227e6215cae3/src/address-parser.ts#L265"
        },
        {
          "name": "VulnCheck Advisory: postal-mime before 4.2.1 Sender Spoofing via Address Parser Domain Truncation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/postal-mime-before-4.2.1-sender-spoofing-via-address-parser-domain-truncation"
        }
      ],
      "title": "postal-mime before 4.2.1 Sender Spoofing via Address Parser Domain Truncation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125756",
    "datePublished": "2026-11-10T15:22:50.822Z",
    "dateReserved": "2026-11-10T12:36:09.511Z",
    "dateUpdated": "2026-11-10T19:04:25.105Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-124016 (GCVE-0-2026-124016)

    Vulnerability from cvelistv5 – Published: 2026-11-10 19:22 – Updated: 2026-11-10 21:03 X_Open Source
    VLAI
    Title
    postal-mime < 4.2.1 Algorithmic Complexity DoS via processLine
    Summary
    postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email messages with boundary lines sharing long prefixes with open boundaries. Attackers can deliver a malicious email with nesting up to the default maxNestingDepth of 256, causing per-line parsing cost to scale as O(depth x shared prefix length) and blocking the Node.js event loop for seconds per message.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-10 21:02 UTC
    CWE
    • CWE-407 - Inefficient Algorithmic Complexity
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 8174 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    postalsys postal-mime Affected: 0 , < 4.2.1 (semver)
    		Create a notification for this product.
    Date Public
    2026-11-10 00:00
    Credits
    Arjun Jain
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-124016",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T21:02:59.254959Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T21:03:45.609Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/postalsys/postal-mime/security/advisories/GHSA-q8wm-54mj-r36p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/postal-mime",
          "product": "postal-mime",
          "repo": "https://github.com/postalsys/postal-mime",
          "vendor": "postalsys",
          "versions": [
            {
              "lessThan": "4.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Arjun Jain"
        }
      ],
      "datePublic": "2026-11-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email messages with boundary lines sharing long prefixes with open boundaries. Attackers can deliver a malicious email with nesting up to the default maxNestingDepth of 256, causing per-line parsing cost to scale as O(depth x shared prefix length) and blocking the Node.js event loop for seconds per message."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T19:22:30.485Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-q8wm-54mj-r36p)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/postalsys/postal-mime/security/advisories/GHSA-q8wm-54mj-r36p"
        },
        {
          "name": "Fixed Release Tag",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/postalsys/postal-mime/releases/tag/v4.2.1"
        },
        {
          "name": "VulnCheck Advisory: postal-mime \u003c 4.2.1 Algorithmic Complexity DoS via processLine",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/postal-mime-algorithmic-complexity-dos-via-processline"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "postal-mime \u003c 4.2.1 Algorithmic Complexity DoS via processLine",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124016",
    "datePublished": "2026-11-10T19:22:30.485Z",
    "dateReserved": "2026-11-06T18:38:38.544Z",
    "dateUpdated": "2026-11-10T21:03:45.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-125756 (GCVE-0-2026-125756)

    Vulnerability from cvelistv5 – Published: 2026-11-10 15:22 – Updated: 2026-11-10 19:04
    VLAI
    Title
    postal-mime before 4.2.1 Sender Spoofing via Address Parser Domain Truncation
    Summary
    postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote attackers can craft From headers that pass SPF/DKIM/DMARC alignment for their own subdomain while PostalMime.parse() reports a spoofed victim sender address.
    Severity
    8.2 (High)
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
    5.9 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-10 18:19 UTC
    CWE
    • CWE-436 - Interpretation Conflict
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 8174 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    postalsys postal-mime Affected: 0 , < 4.2.1 (semver)
    		Create a notification for this product.
    Date Public
    2026-11-10 00:00
    Credits
    Ismail Can Guner
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125756",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T18:19:10.589120Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T19:04:25.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/postal-mime",
          "product": "postal-mime",
          "vendor": "postalsys",
          "versions": [
            {
              "lessThan": "4.2.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ismail Can Guner"
        }
      ],
      "datePublic": "2026-11-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote attackers can craft From headers that pass SPF/DKIM/DMARC alignment for their own subdomain while PostalMime.parse() reports a spoofed victim sender address."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T15:22:50.822Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-jh3p-792r-98gm)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/postalsys/postal-mime/security/advisories/GHSA-jh3p-792r-98gm"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/postalsys/postal-mime/commit/646725704463839f233472453b7c8306bd1dde21"
        },
        {
          "name": "postal-mime v4.2.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/postalsys/postal-mime/releases/tag/v4.2.1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/postalsys/postal-mime/blob/939a220bd518f54d98a088c315d7227e6215cae3/src/address-parser.ts#L265"
        },
        {
          "name": "VulnCheck Advisory: postal-mime before 4.2.1 Sender Spoofing via Address Parser Domain Truncation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/postal-mime-before-4.2.1-sender-spoofing-via-address-parser-domain-truncation"
        }
      ],
      "title": "postal-mime before 4.2.1 Sender Spoofing via Address Parser Domain Truncation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125756",
    "datePublished": "2026-11-10T15:22:50.822Z",
    "dateReserved": "2026-11-10T12:36:09.511Z",
    "dateUpdated": "2026-11-10T19:04:25.105Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}