{"id":"CVE-2026-119762","published":"2026-10-30T18:17:26.957","lastModified":"2026-10-30T19:23:25.493","description":"Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-674"],"vendors":[],"products":[],"references":[{"url":"https://www.axigen.com/kb/show/412","tags":[]},{"url":"https://www.axigen.com/updates/axigen-10.6.40","tags":[]},{"url":"https://www.axigen.com/updates/axigen-10.7.2","tags":[]},{"url":"https://www.vulncheck.com/advisories/axigen-mail-server-before-10.5.69-10.6.40-and-10.7.2-unauthenticated-dos-via-nested-requests","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}