Apache Pony Mail vulnerabilities

4 CVEs affecting Apache Pony Mail, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-41873, published 2026-04-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-4460, published 2017-08-22. Critical severity, CVSS 9.8. EPSS: 6.1% chance of exploitation in the next 30 days. Apache Pony Mail 0.6c through 0.8b allows remote attackers to bypass authentication.
CVE-2019-0218, published 2019-04-22. Medium severity, CVSS 6.1. EPSS: 5.1% chance of exploitation in the next 30 days. A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface.
CVE-2017-5658, published 2018-10-04. Medium severity, CVSS 5.3. EPSS: 1.8% chance of exploitation in the next 30 days. The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private…
CVE-2026-41873, published 2026-04-28. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. ** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin account takeover. This issue affects all…