CVE-2026-108121 — Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service

CVE-2026-108121

Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service PUBLISHED

Description (CNA)

Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from starting after a server reboot, resulting in a denial-of-service (DoS) condition affecting the web server and its hosted virtual hosts.

Affected (CNA)

Vendor / product	Versions
Koozali / SME Server	affected 11.0rc1-215

CWE

CWE-20, CWE-96, CWE-400

References

https://digitalcanion.com/en/security-research/#vendor=koozali

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.