CVE-2026-40193: Maddy Mail Server LDAP Filter Injection Vulnerability
Summary
CVE-2026-40193: Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username. Affects github.com/foxcpp/maddy versions < 0.9.3. Fixed in 0.9.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Maddy is an open-source mail server designed for performance and flexibility. It supports various protocols, including SMTP and IMAP, and is often used in environments requiring secure and efficient email handling. The server's auth.ldap module allows for LDAP-based authentication, which is crucial for integrating with directory services. However, this module is vulnerable to LDAP filter injection due to improper handling of user-supplied input, specifically usernames.
Vulnerability Detail
The vulnerability arises from the auth.ldap module's construction of LDAP search filters and DN strings using unsanitized user input. Specifically, the module uses strings.ReplaceAll() to interpolate usernames directly into LDAP queries without escaping them. This oversight allows attackers to inject arbitrary LDAP filter expressions, leading to identity spoofing, LDAP directory enumeration, and unauthorized attribute value extraction. The vulnerability is exacerbated by the lack of input validation and escaping mechanisms, which could have been addressed by utilizing the ldap.EscapeFilter() function from the go-ldap/ldap/v3 library.
How To Fix
Latest published version: v0.9.6 as of 23 Oct 2026
go get github.com/foxcpp/maddy@v0.9.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.3
This is the first release that contains the fix.
go get github.com/foxcpp/maddy@v0.9.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation on the username field before it is processed by the auth.ldap module. However, the most effective solution is to upgrade to the patched version.
Conclusion
The LDAP filter injection vulnerability in Maddy Mail Server poses significant risks to users, allowing attackers to manipulate authentication processes and extract sensitive information. Upgrading to version 0.9.3 is essential to mitigate these risks effectively.
See every vulnerability recorded for github.com/foxcpp/maddy →
FAQ
LDAP filter injection is a type of attack where an attacker manipulates LDAP queries by injecting malicious input, potentially leading to unauthorized access or data exposure.
If you are using a version of Maddy prior to 0.9.3 and have configured the auth.ldap module, your installation is vulnerable. You can check your version with the command maddy --version.
An attacker can spoof identities, enumerate LDAP directories, and extract sensitive attribute values from user accounts, leading to unauthorized access and data breaches.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software without requiring access to the code or installation. You can check your application against this vulnerability using the Vulert playground.
The CVSS score for this vulnerability is 8.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/foxcpp/maddy.
