PT-2026-32581 · Maddy · Maddy

Published 2026-04-13 · Updated 2026-04-16 · CVE-2026-40193

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions maddy versions prior to 0.9.3

Description The auth.ldap module fails to escape user-supplied usernames when interpolating them into LDAP search filters and DN strings via the strings.ReplaceAll() function. This occurs within the Lookup() and AuthPlain() functions. An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands. This can lead to identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration using wildcard filters, and blind extraction of LDAP attribute values. The extraction is possible by using authentication responses as a boolean oracle or by leveraging timing side-channels between different failure paths.

Recommendations Update to version 0.9.3.

Fix

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2026-40193

GHSA-5835-4GVC-32PC

Affected Products

Maddy

References · 8

• https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc · Vendor Advisory
• https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba · Patch
• https://osv.dev/vulnerability/GHSA-5835-4gvc-32pc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40193 · Security Note
• https://github.com/foxcpp/maddy/releases/tag/v0.9.3 · Note
• https://github.com/foxcpp/maddy · Note
• https://twitter.com/CVEnew/status/2044701602406355161 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044671712323592517 · Twitter Post