CVE-2026-39971: Serendipity SMTP Header Injection Flaw

CVE-2026-39971 Overview

Serendipity, a PHP-powered weblog engine, contains an SMTP header injection vulnerability in versions 2.6-beta2 and below. The email sending functionality in include/functions.inc.php inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header without proper validation. The existing sanitization function serendipity_isResponseClean() is not called on HTTP_HOST before embedding it into outgoing emails.

An attacker who can control the Host header during an email-triggering action—such as comment notifications or subscription emails—can inject arbitrary SMTP headers into outgoing emails. This enables identity spoofing, reply hijacking via manipulated Message-ID threading, and email reputation abuse through the attacker's domain being embedded in legitimate mail headers.

Critical Impact

Attackers can inject arbitrary SMTP headers into legitimate emails, enabling identity spoofing, reply hijacking, and email reputation abuse affecting both the Serendipity installation and downstream email recipients.

Affected Products

• Serendipity versions 2.6-beta2 and below
• Serendipity installations with email notification features enabled
• Environments where comment notifications or subscription emails are active

Discovery Timeline

• 2026-04-15 - CVE-2026-39971 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-39971

Vulnerability Analysis

This vulnerability is classified as CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers), applied here to SMTP headers. The core issue lies in the direct use of user-controllable input—specifically the HTTP Host header—within email Message-ID headers without sanitization.

When Serendipity sends emails for features like comment notifications or subscription confirmations, it constructs Message-ID headers using the server's hostname. The vulnerable code path retrieves this value from $_SERVER['HTTP_HOST'], which is directly controllable by the attacker via the HTTP request. By crafting a malicious Host header containing CRLF sequences and additional SMTP headers, an attacker can inject arbitrary headers into outgoing emails.

The impact includes identity spoofing through injected From or Reply-To headers, manipulation of email threading through crafted Message-ID values, and potential email reputation damage when attacker-controlled domains appear in legitimate mail headers.

Root Cause

The root cause is the failure to sanitize the $_SERVER['HTTP_HOST'] value before embedding it into SMTP headers. While Serendipity includes a sanitization function (serendipity_isResponseClean()), this function is not invoked on the HTTP_HOST value before it is used in the email Message-ID construction within include/functions.inc.php. This oversight allows CRLF injection, enabling attackers to break out of the intended header context and inject additional SMTP headers.

Attack Vector

The attack is network-based and requires no authentication. An attacker can exploit this vulnerability by:

1. Triggering an email-sending action on the Serendipity installation (e.g., submitting a comment on a blog post configured to send notifications)
2. Manipulating the HTTP Host header in the request to include CRLF sequences followed by malicious SMTP headers
3. The injected headers are then included in the outgoing email, potentially affecting recipients who receive the modified message

The vulnerability manifests in the email sending functionality within include/functions.inc.php. The Host header value flows unsanitized into the Message-ID SMTP header construction. For technical implementation details, see the GitHub Security Advisory GHSA-458g-q4fh-mj6r.

Detection Methods for CVE-2026-39971

Indicators of Compromise

• Unusual or malformed Host headers in web server access logs containing CRLF sequences (%0d%0a or \r\n)
• Outgoing emails with unexpected or additional SMTP headers not normally present
• Email delivery logs showing messages with suspicious Message-ID formats or unexpected domains
• Reports from email recipients about spoofed or manipulated email headers

Detection Strategies

• Monitor web server access logs for requests containing CRLF-encoded characters (%0d, %0a, %0D, %0A) in Host headers
• Implement email header inspection on outgoing mail servers to detect anomalous header injection patterns
• Deploy web application firewall (WAF) rules to block requests with CRLF sequences in Host headers
• Review Serendipity installation logs for unusual email notification activity patterns

Monitoring Recommendations

• Enable detailed logging for the email sending functionality in Serendipity
• Configure alerting for Host header values that deviate from expected server hostnames
• Monitor email bounce rates and reputation scores for domains associated with the Serendipity installation
• Implement log correlation between web server requests and outgoing email activity

How to Mitigate CVE-2026-39971

Immediate Actions Required

• Upgrade Serendipity to version 2.6.0 or later immediately
• Review recent outgoing emails for signs of header injection or spoofing
• Temporarily disable email notification features if immediate patching is not possible
• Implement WAF rules to block requests with malicious Host headers

Patch Information

The vulnerability has been fixed in Serendipity version 2.6.0. The patch addresses the issue by properly sanitizing the HTTP_HOST value before embedding it into SMTP headers. Organizations should upgrade to version 2.6.0 or later to remediate this vulnerability.

For detailed release information, see the Serendipity 2.6.0 Release on GitHub.

Workarounds

• Implement Host header validation at the web server or reverse proxy level to reject requests with unexpected Host values
• Configure WAF rules to strip or block CRLF sequences from incoming HTTP headers
• Use allowlist-based Host header validation to accept only legitimate server hostnames
• Disable email notification features (comment notifications, subscription emails) until patching is possible

# Apache mod_headers configuration to validate Host header
# Add to .htaccess or Apache configuration
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP_HOST} !^(www\.)?yourdomain\.com$ [NC]
    RewriteRule ^ - [F]
</IfModule>