CVE-2025-40631 Information

Description

HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected.

Reference

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-icewarp-mail-server