CVE-2026-40193: LDAP Filter Injection in Maddy Mail Server Due to Unsanitized Username
Summary
CVE-2026-40193: Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username in github.com/foxcpp/maddy. Affects github.com/foxcpp/maddy versions < 0.9.3. Fixed in 0.9.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Maddy Mail Server is an open-source email server written in Go, designed for simplicity and performance. It supports various protocols and features, including IMAP and SMTP, making it a versatile choice for email handling. However, it is susceptible to an LDAP filter injection vulnerability that arises from unsanitized user input, specifically usernames. This flaw can lead to unauthorized access or manipulation of LDAP queries, posing a significant security risk.
Vulnerability Detail
The vulnerability in Maddy Mail Server is an LDAP Filter Injection caused by the lack of proper sanitization of user-supplied usernames. Attackers can exploit this flaw by crafting malicious usernames that alter the intended LDAP query structure. This can result in unauthorized data access or manipulation, potentially allowing attackers to bypass authentication mechanisms or retrieve sensitive information from the LDAP directory. The issue originates from the way the application constructs LDAP queries without validating or escaping user input, making it a critical security concern.
How To Fix
Latest published version: v0.9.6 as of 23 Oct 2026
go get github.com/foxcpp/maddy@v0.9.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.3
This is the first release that contains the fix.
go get github.com/foxcpp/maddy@v0.9.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any user input, especially usernames, is properly sanitized before being used in LDAP queries. This can involve escaping special characters or validating input against a whitelist of acceptable values.
Conclusion
The LDAP Filter Injection vulnerability in Maddy Mail Server highlights the importance of input sanitization in preventing security risks. By updating to the latest version and implementing proper input validation, users can protect their applications from potential attacks.
See every vulnerability recorded for github.com/foxcpp/maddy →
FAQ
LDAP Filter Injection is a type of attack where an attacker manipulates LDAP queries by injecting malicious input, potentially leading to unauthorized access or data manipulation.
You can check if your application is affected by this vulnerability using Vulert's playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any signup.
If exploited, this vulnerability can allow attackers to bypass authentication, access sensitive information, or manipulate data within the LDAP directory, leading to severe security breaches.
Yes, if an attacker successfully exploits this vulnerability, they may gain access to sensitive data or modify existing data, potentially leading to data loss or corruption.
It is recommended to regularly check for updates and apply patches as soon as they are available to mitigate the risk of vulnerabilities in your software.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/foxcpp/maddy.
