CVE-2026-40193 foxcpp CVE debrief

Who should care

Defenders responsible for mail server security, particularly those using maddy versions prior to 0.9.3, should assess exposure and apply patches or upgrades to prevent LDAP injection attacks.

Why it matters

The LDAP injection vulnerability in maddy versions prior to 0.9.3 allows for identity spoofing, LDAP directory enumeration, and blind extraction of LDAP attribute values. Defenders should assess exposure, apply patches or upgrades, and monitor authentication responses to prevent LDAP injection attacks.

• Identity spoofing through manipulated LDAP filter results
• LDAP directory enumeration via wildcard filters
• Blind extraction of LDAP attribute values using authentication responses

Technical summary

The maddy mail server versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module. This allows an attacker with network access to the SMTP submission or IMAP interface to inject arbitrary LDAP filter expressions, enabling identity spoofing, LDAP directory enumeration, and blind extraction of LDAP attribute values. The vulnerability is due to the use of strings.ReplaceAll() without any LDAP filter escaping, despite the availability of the ldap.EscapeFilter() function. The issue affects three code paths: the Lookup() filter, the AuthPlain() DN template, and the AuthPlain() filter.

Defensive priority

High

Recommended defensive actions

• Assess exposure by checking if maddy versions prior to 0.9.3 are in use
• Apply patches or upgrade to maddy version 0.9.3 or later
• Monitor authentication responses for potential LDAP injection attempts
• Review and update LDAP configuration to prevent injection vulnerabilities
• Implement additional logging and monitoring to detect potential exploitation attempts
• Conduct regular vulnerability assessments to identify and address potential weaknesses
• Review and update incident response plans to include procedures for responding to LDAP injection attacks

Evidence notes

The CVE record and NVD entry provide details on the LDAP injection vulnerability in maddy versions prior to 0.9.3. The vulnerability allows for identity spoofing, LDAP directory enumeration, and blind extraction of LDAP attribute values.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.