CVE-2026-50878: Feuerhamster MailForm DoS Vulnerability

CVE-2026-50878 Overview

CVE-2026-50878 is a denial of service vulnerability in the attachment handling component of Feuerhamster MailForm v1.1.0. A remote attacker can send a crafted request to exhaust resources and render the service unavailable. The flaw is categorized under [CWE-400] Uncontrolled Resource Consumption. No authentication or user interaction is required, making the issue trivially reachable over the network.

Critical Impact
Unauthenticated remote attackers can disrupt MailForm availability by submitting a crafted attachment request that triggers resource exhaustion.

Affected Products

Feuerhamster MailForm v1.1.0
Attachment handling component of MailForm
Deployments exposing the MailForm endpoint to untrusted networks

Discovery Timeline

2026-06-15 - CVE-2026-50878 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database
2026-06-18 - EPSS score recorded at 0.441% (35.05 percentile)

Technical Details for CVE-2026-50878

Vulnerability Analysis

The vulnerability resides in how Feuerhamster MailForm v1.1.0 processes file attachments submitted through its form interface. The component fails to apply adequate bounds on incoming attachment data, allowing an attacker to consume excessive memory, CPU, or storage resources. When the crafted request is processed, the service becomes unresponsive to legitimate users.

The issue maps to [CWE-400] Uncontrolled Resource Consumption. Resource-exhaustion flaws in form handlers commonly result from missing size limits, missing rate limiting, or inefficient parsing routines that scale poorly with attacker-controlled inputs.

Root Cause

The root cause is improper enforcement of resource constraints in the attachment processing path. The component does not bound the work performed when handling a maliciously shaped attachment payload. As a result, a single request can monopolize server resources and degrade or halt the service.

Attack Vector

The attack vector is network-based. An unauthenticated attacker submits a crafted HTTP request to the MailForm endpoint that hosts the vulnerable attachment handler. Because no privileges or user interaction are required, the vulnerability can be exploited directly by any network-reachable client. A proof-of-concept is publicly referenced via a GitHub Gist with PoC.

No verified code examples are available. See the linked PoC gist for technical details on the request structure used to trigger the condition.

Detection Methods for CVE-2026-50878

Indicators of Compromise

Spikes in CPU, memory, or disk usage on hosts running Feuerhamster MailForm coinciding with inbound POST requests to attachment endpoints.
Repeated requests from a single source IP targeting the MailForm submission path with abnormally large or malformed multipart/form-data payloads.
MailForm process crashes, restarts, or unresponsiveness logged by the host or reverse proxy.

Detection Strategies

Inspect web server access logs for POST requests to MailForm attachment URIs with unusually high Content-Length values or anomalous MIME boundaries.
Correlate web request volume with server-side resource metrics to identify low-volume, high-impact request patterns characteristic of algorithmic DoS.
Apply web application firewall (WAF) signatures that flag malformed multipart payloads and oversized attachments to MailForm endpoints.

Monitoring Recommendations

Configure alerts on availability monitors for the MailForm service and the application host.
Track 5xx error rates and request timeouts on the reverse proxy fronting MailForm.
Forward web server, WAF, and host telemetry to a centralized analytics platform for correlation across request volume, source IP reputation, and resource utilization.

How to Mitigate CVE-2026-50878

Immediate Actions Required

Restrict network exposure of the MailForm endpoint to trusted networks or place it behind authentication where possible.
Deploy WAF or reverse proxy rules to cap request body size and reject malformed multipart submissions to the attachment handler.
Apply rate limiting on the MailForm submission path per source IP to blunt repeated exploitation attempts.

Patch Information

No vendor advisory or patched release was referenced in the NVD entry at the time of publication. Operators should monitor the Feuerhamster MailForm project channels for an updated release and upgrade once a fixed version is published.

Workarounds

Enforce strict upload size limits at the reverse proxy (for example, client_max_body_size in nginx) ahead of the MailForm application.
Disable attachment handling in MailForm configuration if attachments are not required by the deployment.
Terminate or isolate the MailForm service if exposure cannot be limited until a vendor patch is available.

bash

# Configuration example: nginx body size limit and rate limit in front of MailForm
http {
    limit_req_zone $binary_remote_addr zone=mailform:10m rate=5r/m;

    server {
        location /mailform/ {
            client_max_body_size 1m;
            limit_req zone=mailform burst=5 nodelay;
            proxy_pass http://mailform_backend;
        }
    }
}