MediumFix available
roundcube — security advisory
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.
- Products
- roundcube
- Affected versions
- 1.6.1+dfsg-1, 1.6.11+dfsg-1, 1.6.12+dfsg-0+deb13u1, 1.6.12+dfsg-1, 1.6.13+dfsg-0+deb13u1, 1.6.13+dfsg-1, 1.6.14+dfsg-1, 1.6.15+dfsg-0+deb13u1, 1.6.15+dfsg-1, 1.6.16+dfsg-0+deb13u1, 1.6.16+dfsg-1, 1.6.2+dfsg-1, 1.6.3+dfsg-1, 1.6.3+dfsg-1~deb12u1, 1.6.3+dfsg-2, 1.6.4+dfsg-1, 1.6.4+dfsg-1~deb12u1, 1.6.5+dfsg-1, 1.6.5+dfsg-1+deb12u2, 1.6.5+dfsg-1+deb12u3, 1.6.5+dfsg-1+deb12u4, 1.6.5+dfsg-1+deb12u5, 1.6.5+dfsg-1+deb12u6, 1.6.5+dfsg-1+deb12u7, 1.6.5+dfsg-1+deb12u8, 1.6.5+dfsg-1+deb12u9, 1.6.5+dfsg-1~deb12u1
- Fixed versions
- 1.6.17+dfsg-0+deb13u1, 1.6.17+dfsg-1, 1.6.5+dfsg-1+deb12u10
- CVEs
- CVE-2026-62642
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:53 UTC · Revision 2
Source evidence
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.
osv:DEBIAN-CVE-2026-62642
roundcube
Fixed versions: 1.6.5+dfsg-1+deb12u10
roundcube
Fixed versions: 1.6.17+dfsg-0+deb13u1
roundcube
Fixed versions: 1.6.17+dfsg-1
Complete source record
{
"id": "1d410c97f602773a03a3a3034fd5d772bedcceac5fbfce327909af56dde1104e",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-62642",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-62642",
"summary": "In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.",
"evidence": "osv:DEBIAN-CVE-2026-62642",
"products": [
{
"name": {
"value": "roundcube",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.6.5+dfsg-1+deb12u10",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "1.6.1+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.2+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.3+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.3+dfsg-1~deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.3+dfsg-2",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.4+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.4+dfsg-1~deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u2",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u3",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u4",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u5",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u6",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u7",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u8",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1+deb12u9",
"evidence": "/affected/0/versions"
},
{
"value": "1.6.5+dfsg-1~deb12u1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "roundcube",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.6.17+dfsg-0+deb13u1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "1.6.11+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.12+dfsg-0+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.12+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.13+dfsg-0+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.13+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.14+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.15+dfsg-0+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.15+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.16+dfsg-0+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "1.6.16+dfsg-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "roundcube",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.6.17+dfsg-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "1.6.11+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.6.12+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.6.13+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.6.14+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.6.15+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.6.16+dfsg-1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2026-62642",
"aliases": [
"DEBIAN-CVE-2026-62642"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.5+dfsg-1+deb12u10"
}
]
}
],
"package": {
"name": "roundcube",
"purl": "pkg:deb/debian/roundcube?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1.6.1+dfsg-1",
"1.6.2+dfsg-1",
"1.6.3+dfsg-1",
"1.6.3+dfsg-1~deb12u1",
"1.6.3+dfsg-2",
"1.6.4+dfsg-1",
"1.6.4+dfsg-1~deb12u1",
"1.6.5+dfsg-1",
"1.6.5+dfsg-1+deb12u2",
"1.6.5+dfsg-1+deb12u3",
"1.6.5+dfsg-1+deb12u4",
"1.6.5+dfsg-1+deb12u5",
"1.6.5+dfsg-1+deb12u6",
"1.6.5+dfsg-1+deb12u7",
"1.6.5+dfsg-1+deb12u8",
"1.6.5+dfsg-1+deb12u9",
"1.6.5+dfsg-1~deb12u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62642.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.17+dfsg-0+deb13u1"
}
]
}
],
"package": {
"name": "roundcube",
"purl": "pkg:deb/debian/roundcube?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1.6.11+dfsg-1",
"1.6.12+dfsg-0+deb13u1",
"1.6.12+dfsg-1",
"1.6.13+dfsg-0+deb13u1",
"1.6.13+dfsg-1",
"1.6.14+dfsg-1",
"1.6.15+dfsg-0+deb13u1",
"1.6.15+dfsg-1",
"1.6.16+dfsg-0+deb13u1",
"1.6.16+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62642.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.17+dfsg-1"
}
]
}
],
"package": {
"name": "roundcube",
"purl": "pkg:deb/debian/roundcube?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1.6.11+dfsg-1",
"1.6.12+dfsg-1",
"1.6.13+dfsg-1",
"1.6.14+dfsg-1",
"1.6.15+dfsg-1",
"1.6.16+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62642.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-25T09:47:30.213614639Z",
"provider": "osv",
"upstream": [
"CVE-2026-62642"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-62642"
]
},
"related_cves": [
{
"value": "CVE-2026-62642",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 445189,
"published_at": "2026-07-14T16:17:04.53+00:00"
}