Description

When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pro releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplicate messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUTH stage. Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-28T12:16:27.483Z",
  "pubdate": "2026-08-28T12:16:27.483Z",
  "executiveSummary": "The submission-login process is susceptible to a denial-of-service vulnerability triggered by an epoll() panic when the mail_max_userip_connections limit is reached. This vulnerability stems from improper file descriptor handling within the submission-login component.\nDepending on the operational mode, the impact ranges from the termination of a single connection to the widespread disruption of all active connections handled by the affected process. This behavior can lead to service instability, failure to relay messages, or potential duplicate message delivery under specific conditions.\nThe vulnerability is inherent to the process management logic and can be triggered by legitimate users or malicious actors attempting to exhaust connection limits. There are no known public exploits for this issue, but the risk is heightened in high-performance mode where a single crash results in broader service outages. Mitigation requires updating to a non-vulnerable version and tuning connection limits to manage process load.",
  "technicalDetails": "The root cause of this vulnerability is a flaw in the epoll() event notification handling within the submission-login component. When the configured limit, defined by 'mail_max_userip_connections' (defaulting to 10), is exceeded, the internal state of the process becomes inconsistent regarding file descriptor management. This inconsistency triggers an assertion failure or a panic during the epoll loop execution.\nThe exploit flow begins when an attacker or user initiates a volume of connections that hits the 'mail_max_userip_connections' threshold. Once this limit is reached, the submission-login process fails to manage the file descriptors associated with the new connection attempts correctly. In high-security mode, the error handling is localized, resulting in the termination of only the most recent connection attempt. However, in high-performance mode—a common configuration for Pro release users—the process architecture facilitates the handling of multiple connections per process; a failure here induces a crash of the entire process, dropping all existing submission-login connections associated with that process instance.\nThe vulnerability manifests during the authentication (AUTH) stage. The impact of the crash is dependent on the backend processing architecture. If TLS is not utilized during the submission relay to the backend, the crash primarily results in a denial-of-service condition, as the connection is severed prior to the message being committed. If the crash occurs after a transaction state has been partially processed, there is an increased risk of duplicate message delivery or transaction failure. This issue effectively leverages resource exhaustion as a vector to force an unintended state transition within the event-loop handler.\nThe vulnerability is tied to the internal process handling logic for concurrent connections. Because the crash occurs before authentication is finalized in most scenarios, it does not strictly require advanced privileges, though it requires network exposure to the submission service. The primary post-exploitation impact is the disruption of mail submission services and the potential corruption of mail delivery integrity."
}