CVE-2026-110871
Description
A flaw was found in nodemailer. A remote attacker can trigger a Denial of Service (DoS) by submitting emails containing excessively long headers or large recipient lists that fold into numerous continuation lines. Inefficient header parsing in the message parser component leads to excessive CPU resource consumption, which blocks the application event loop during email signing.
Statement
A MODERATE impact denial of service vulnerability exists in the nodemailer package, which is bundled as a dependency in several Red Hat products, including Red Hat Developer Hub (rhdh-hub-rhel9 container images in the 1.9 and 1.10 streams), Red Hat Ansible Automation Platform (bootc-automation-portal-rhel9), the grafana component of Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS, and cloud.redhat.com services (backoffice-proxy). The flaw is in the MessageParser.parseHeaders function, which unfolds email headers with quadratic complexity. A remote attacker who can submit messages with excessively long headers or large recipient lists that fold into numerous continuation lines can cause excessive CPU consumption, blocking the Node.js event loop while the message is parsed and DKIM-signed and making the application unresponsive. Red Hat assesses this flaw as MODERATE severity (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); this differs from the CVEORG CVSS 4.0 score of 7.1 (IMPORTANT) in the upstream CVE record, which reflects the CVSS 4.0 scoring model. The Red Hat Hardened Images (Hummingbird) affects for grafana12.4, grafana13.1, and grafana13.2 are DELEGATED and were resolved by the Hummingbird business unit as NOTAFFECTED, with their trackers closed as Not a Bug ('Component not Present'). For the remaining affected products, the fix is DEFERRED because the impact is MODERATE with a CVSS score below 7.0, for which trackers are not filed; the residual risk is that a remote attacker can block the event loop of Node.js applications that use affected nodemailer versions for email generation and DKIM signing.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream project has released a fixed version (nodemailer 10.0.10); affected Red Hat products are expected to receive the updated dependency through their regular update streams once the deferred updates are delivered.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
When an attacker can directly invoke the blocking code, or the blocking code can be affected by environmental conditions that can be influenced by an attacker, then this can lead to a denial of service by causing unexpected hang or freeze of the code. An unexpected call to blocking code can trigger an infinite loop, or a large loop that causes the software to pause and wait indefinitely.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
