CVE-2026-125756
5.9 MEDIUMpublic exploit availablePublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote attackers can craft From headers that pass SPF/DKIM/DMARC alignment for their own subdomain while PostalMime.parse() reports a spoofed victim sender address.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-436
Public exploit & PoC references
- https://github.com/postalsys/postal-mime/blob/939a220bd518f54d98a088c315d7227e6215cae3/src/address-parser.ts#L265
- https://github.com/postalsys/postal-mime/commit/646725704463839f233472453b7c8306bd1dde21
- https://github.com/postalsys/postal-mime/releases/tag/v4.2.1
- https://github.com/postalsys/postal-mime/security/advisories/GHSA-jh3p-792r-98gm
All references
- https://github.com/postalsys/postal-mime/blob/939a220bd518f54d98a088c315d7227e6215cae3/src/address-parser.ts#L265
- https://github.com/postalsys/postal-mime/commit/646725704463839f233472453b7c8306bd1dde21
- https://github.com/postalsys/postal-mime/releases/tag/v4.2.1
- https://github.com/postalsys/postal-mime/security/advisories/GHSA-jh3p-792r-98gm
- https://www.vulncheck.com/advisories/postal-mime-before-4.2.1-sender-spoofing-via-address-parser-domain-truncation
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100351PoC
- MEDIUMCVE-2026-101019
- HIGHCVE-2026-103866
- HIGHCVE-2026-104269PoC
- MEDIUMCVE-2026-106430
- HIGHCVE-2026-106505PoC
- MEDIUMCVE-2026-107825PoC
- MEDIUMCVE-2026-107835PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.