CVE-2026-41873: Apache Pony Mail: admin account takeover via HTTP request smuggling
CVE-2026-41873 is an HTTP request smuggling issue (CWE-444) in the Lua implementation of Apache Pony Mail that can lead to takeover of an administrator account. The record states that the Lua implementation is retired and that no fixed release is planned, so remediation centers on retiring or restricting the instance. No confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-41873 is classified as CWE-444 (HTTP Request Smuggling), described in the record as an inconsistent interpretation of HTTP requests that leads to administrator account takeover in Apache Pony Mail. The issue is marked as unsupported when assigned, and the record notes it only affects products no longer supported by the maintainer. The CNA is the Apache Software Foundation, and the record was published on 2026-04-28 and is in Modified status.
Impact
The record describes the impact as admin account takeover. The CVSS 3.1 vector in the record (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates confidentiality, integrity and availability impact as high, with a base score of 9.8 from NVD. The SSVC fields in the record indicate automatable: yes and total technical impact. These values describe the severity as scored by the sources and do not confirm any specific exploit path.
Affected products and versions
- Product: Apache Software Foundation Pony Mail, Lua implementation.
- The description states that all versions of the Lua implementation are affected.
- The record does not list specific version strings; the affected version range is recorded as not specified by the source.
- A Python implementation named Pony Mail Foal is described as under development and not affected, but not yet released.
Exploitation status
The CISA KEV catalog entry in the record is not listed. No confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation field is recorded as none. The EPSS probability is 0.00738 with a percentile of 0.5403, dated 2026-10-23; these are estimates, not evidence of exploitation.
Remediation and mitigation
- The maintainer states that the Lua implementation is retired and that no fixed version is planned, so no patched release is available from the record.
- The record recommends finding an alternative to the product.
- Until the instance is retired, restrict access to trusted users only, and limit exposure of the administrative interface to the network.
- Review administrator accounts and sessions on any affected instance for signs of unexpected access.
Detection guidance
- Review web server and reverse proxy logs for requests with inconsistent or ambiguous HTTP framing, and for unexpected administrative actions.
- Monitor for new or changed administrator accounts and for logins from unfamiliar sources.
- Where a front-end proxy sits in front of the application, check for differences in how it and the backend interpret request boundaries.
Limitations of the available information
The record does not provide specific affected version strings, fixed versions, technical details of the smuggling behavior, or confirmed exploitation timelines. Fix information is absent because the product is retired, which is not the same as the absence of a fix in a supported release. The CVSS and SSVC values are taken from the record and were not independently verified.
Frequently asked questions
Is CVE-2026-41873 being actively exploited?
The CISA KEV catalog entry in the record is not listed, and no confirmed exploitation in the wild appears in the sources consulted.
Is there a patch for this issue?
The record states the maintainer does not plan to release a fixed version of the retired Lua implementation. The recommended path is to find an alternative or restrict access to trusted users.
Which versions are affected?
The record says all versions of the Lua implementation are affected but does not list specific version strings.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.