CVE-2026-114731
Description
A flaw was found in Roundcube Webmail. This flaw allows a remote attacker to trigger a Denial of Service (DoS) by exhausting server memory. The application's stylesheet proxy fails to enforce size limits or read timeouts when retrieving external content. By directing the proxy to fetch an attacker-controlled stylesheet, an attacker can force the server to load unbounded data into memory, causing the application to become unresponsive.
Statement
A flaw was found in Roundcube Webmail's CSS proxy (utils/modcss action). A remote unauthenticated attacker can direct the proxy to fetch an attacker-controlled stylesheet that is read fully into memory with no size limit or read timeout, exhausting server memory and causing denial of service. Fixed in 1.6.20 and 1.7.5 (5 MB cap, streamed read, read timeout). Red Hat does not ship roundcubemail; community builds on fedora-all and epel-all are affected and delegated.
Mitigation
Update to roundcubemail 1.6.20 (1.6 LTS) or 1.7.5, which add a 5 MB size limit, streamed content reading, and a read timeout to the CSS proxy. Restricting or disabling the modcss/CSS proxy feature reduces exposure.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
