CVE-2025-40631 — HTTP host header injection vulnerability in IceWarp Mail Server

CVE-2025-40631

HTTP host header injection vulnerability in IceWarp Mail Server PUBLISHED

Description (CNA)

HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected.

Affected (CNA)

Vendor / product	Versions
Icewarp / Icewarp Mail Server	affected 11.4.0

CWE

CWE-644

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-icewarp-mail-server

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.