CVE-2026-50878: Feuerhamster MailForm v1.1.0 Denial of Service Vulnerability

Technical summary

CVE-2026-50878 is a Denial of Service vulnerability affecting Feuerhamster MailForm v1.1.0's attachment handling component. The flaw is rooted in improper resource management (CWE-400: Uncontrolled Resource Consumption), allowing unauthenticated network-based attackers to exhaust application resources via a crafted request. The vulnerability requires no user interaction and impacts service availability without affecting confidentiality or integrity. CVSS 3.1 score of 7.5 reflects the HIGH severity classification.

Business impact

Organizations running Feuerhamster MailForm v1.1.0 face potential service disruptions. An attacker can render the mail form application unavailable to end-users, disrupting email submission workflows and affecting any dependent business processes. Since exploitation does not require authentication or special access, the attack surface is broad. The absence of this vulnerability from CISA's Known Exploited Vulnerabilities (KEV) catalog as of the vulnerability publication date does not diminish the operational risk posed by unpatched instances.

Affected systems

Feuerhamster MailForm version 1.1.0 is explicitly affected. Organizations should audit their deployments to identify instances running this version. If vendor information on affected version ranges or compatibility of patches with other versions becomes available, cross-reference against your inventory.

Exploitability

The vulnerability is relatively straightforward to exploit. It requires only network access and a crafted HTTP request—no authentication, no user interaction, and no complex attack chains. The low attack complexity and absence of privilege requirements mean that opportunistic attackers, as well as targeted threat actors, can readily attempt exploitation. However, no public exploit code is known to exist in widely-used repositories at the time of advisory publication.

Remediation

Upgrade Feuerhamster MailForm to a patched version beyond v1.1.0. Consult the vendor's security advisories to identify the correct target version for your deployment. If an immediate patch is unavailable, temporarily restrict network access to the mail form application via firewall rules, rate limiting, or IP allowlisting to reduce exposure while a patch is prepared or procured.

Patch guidance

Contact Feuerhamster or check their official security advisories for patch availability and installation procedures for v1.1.0. Verify compatibility with any dependent systems or plugins before deploying patches to production. Plan a timely update given the HIGH severity and ease of exploitation. Test patches in a non-production environment first to ensure no functional regressions.

Detection guidance

Monitor for unusual request patterns targeting the mail form's attachment handling endpoints, such as repeated requests with malformed or oversized payloads. Watch for application crashes, restarts, or elevated CPU/memory consumption correlated with specific request signatures. Intrusion detection systems should flag requests designed to exhaust resources. Review application logs for errors or warnings originating from the attachment processing component. If applicable, enable verbose logging on the attachment handler during investigation.

Why prioritize this

This vulnerability merits rapid patching because of its HIGH CVSS severity, ease of exploitation (network-accessible, no authentication), and direct impact on service availability. The lack of KEV listing does not reduce urgency; the vulnerability is trivial to exploit and could enable competitors, extortionists, or other adversaries to disrupt your email intake mechanisms.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-exploitable vulnerability with low attack complexity, requiring no privileges or user interaction, that significantly impacts availability. Although confidentiality and integrity are not affected, the uncontrolled resource consumption allows a remote attacker to fully degrade or disable the service, resulting in the highest impact rating for availability (High).

Frequently asked questions