PT-2026-35747 · Pony Mail · Pony Mail

Li Jiantao + 1 · Published 2026-04-28 · Updated 2026-05-26 · CVE-2026-41873

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pony Mail (Lua implementation) (affected versions not specified)

Description Inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, allows for admin account takeover. This occurs when a front-end server and a back-end server disagree on the boundaries of an HTTP request, potentially allowing an attacker to "smuggle" a request to the back-end.

Recommendations Restrict access to the instance to trusted users. Find an alternative software solution.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-41873

Affected Products

Pony Mail

References · 10

• https://lists.apache.org/thread/1c7jtxjobh280kqc13fzw1cg57xrz951 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41873 · Security Note
• https://t.me/proxy_bar/3420 · Telegram Post
• https://twitter.com/ThreatLevelAI/status/2049210480590213620 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/28/17 · Note
• https://twitter.com/OrizonCyber/status/2049202056674656372 · Twitter Post
• https://twitter.com/starlabs_sg/status/2053991240799330343 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049170360336007478 · Twitter Post
• https://twitter.com/oss_security/status/2049320111853498508 · Twitter Post
• https://twitter.com/CVEnew/status/2049227564074312126 · Twitter Post