Description
Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Axigen | Axigen Mail Server | 10.0.0 – < 10.5.69, 10.6.0 – < 10.6.40, 10.7.0 – < 10.7.2 | 10.5.69 |
References
- https://www.axigen.com/kb/show/412 vendor-advisory
- https://www.axigen.com/updates/axigen-10.6.40 release-notes
- https://www.axigen.com/updates/axigen-10.7.2 release-notes
- VulnCheck Advisory: Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests third-party-advisory