CVE-2026-41873

The vulnerability results from inconsistent interpretation of HTTP requests by the server and intermediary network components (HTTP Request/Response Smuggling). An attacker can craft HTTP requests in such a way that different infrastructure layers interpret request boundaries differently, leading to unauthorized session or administrator account takeover. The issue affects only the Lua-based implementation.

An unauthenticated network attacker can take over the application's administrator account, gaining full control over the Apache Pony Mail instance.

The vendor does not plan to release a patch since the Lua implementation is officially deprecated. Migration to an alternative solution is recommended, or access to the instance should be restricted to trusted users only. Monitor the availability of the Python implementation (Pony Mail Foal) as a successor.

All versions of the Lua implementation of Apache Pony Mail. The Python implementation (Pony Mail Foal) is not vulnerable, but has not yet been released.