CVE-2026-114723
Description
A flaw was found in Roundcube Webmail. A remote attacker can cause a Denial of Service (DoS) by submitting a crafted image with excessively large dimensions. When thumbnail generation falls back to the GD graphics library on non-Windows platforms, available-memory checks are not enforced. This allows the application to process the image without resource limits, potentially exhausting server memory.
Statement
A low-severity denial-of-service flaw was found in Roundcube Webmail. When thumbnail generation falls back to the GD graphics library on non-Windows platforms, the available-memory check is not enforced, so a remote attacker can submit a crafted image with excessively large dimensions and exhaust server memory. Update to Roundcube Webmail 1.6.20 or 1.7.5, or backport the upstream one-line fix that applies the memory check on all platforms.
Mitigation
Update to Roundcube Webmail 1.6.20 or 1.7.5, which apply the available-memory check on all platforms during GD fallback thumbnail generation. For EPEL 9's roundcubemail 1.5.15 (no upstream 1.5.x fix released), backport the one-line fix from upstream commits 0bea8112 / d28a5703 that removes the Windows-only condition around mem_check(), or update to a fixed version. Alternatively, ensure ImageMagick is configured to handle image conversion so the GD fallback path is not taken.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
