CVE-2026-42395
Received Received - Intake

Trusted Proxy NUL Byte Login Crash in Open-Xchange

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: Open-Xchange

Description
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-42395
EUVD
EUVD-2026-67677

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a trusted proxy sending forwarding information with a NUL byte, which crashes the login process on the next attempt. This causes login failures and can lead to service degradation or denial of service for users.

Detection Guidance

This vulnerability may cause login process crashes or denial of service. Monitor login failures or crashes on systems using trusted proxies. Check logs for login process terminations or unexpected errors after proxy interactions.

Impact Analysis

The impact includes login failures and potential service disruptions for users. If trusted proxies are misconfigured or compromised, attackers could exploit this to deny login access to legitimate users.

Mitigation Strategies

Restrict trusted proxy networks to only hosts fully under your control. Update to a non-vulnerable version of the software immediately. Ensure no untrusted proxies are listed as trusted.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42395. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart