{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34752", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T19:17:10.225Z", "datePublished": "2026-04-02T18:42:38.367Z", "dateUpdated": "2026-04-03T15:47:34.494Z"}, "containers": {"cna": {"title": "Haraka affected by DoS via `__proto__` email header", "problemTypes": [{"descriptions": [{"cweId": "CWE-248", "lang": "en", "description": "CWE-248: Uncaught Exception", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/haraka/Haraka/security/advisories/GHSA-xph3-r2jf-4vp3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/haraka/Haraka/security/advisories/GHSA-xph3-r2jf-4vp3"}, {"name": "https://github.com/haraka/Haraka/releases/tag/v3.1.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/haraka/Haraka/releases/tag/v3.1.4"}], "affected": [{"vendor": "haraka", "product": "Haraka", "versions": [{"version": "< 3.1.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T18:42:38.367Z"}, "descriptions": [{"lang": "en", "value": "Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the Haraka worker process. This issue has been patched in version 3.1.4."}], "source": {"advisory": "GHSA-xph3-r2jf-4vp3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-03T15:47:22.511467Z", "id": "CVE-2026-34752", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T15:47:34.494Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34752", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-03T15:47:22.511467Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T15:47:28.929Z"}}], "cna": {"title": "Haraka affected by DoS via `__proto__` email header", "source": {"advisory": "GHSA-xph3-r2jf-4vp3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "haraka", "product": "Haraka", "versions": [{"status": "affected", "version": "< 3.1.4"}]}], "references": [{"url": "https://github.com/haraka/Haraka/security/advisories/GHSA-xph3-r2jf-4vp3", "name": "https://github.com/haraka/Haraka/security/advisories/GHSA-xph3-r2jf-4vp3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/haraka/Haraka/releases/tag/v3.1.4", "name": "https://github.com/haraka/Haraka/releases/tag/v3.1.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the Haraka worker process. This issue has been patched in version 3.1.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "CWE-248: Uncaught Exception"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-02T18:42:38.367Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34752", "state": "PUBLISHED", "dateUpdated": "2026-04-03T15:47:34.494Z", "dateReserved": "2026-03-30T19:17:10.225Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-02T18:42:38.367Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Haraka is a Node.js mail server. Prior to version 3.1.4, sending an email with __proto__: as a header name crashes the Haraka worker process. This issue has been patched in version 3.1.4."}], "id": "CVE-2026-34752", "lastModified": "2026-04-03T16:10:23.730", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-02T19:21:33.517", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/haraka/Haraka/releases/tag/v3.1.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/haraka/Haraka/security/advisories/GHSA-xph3-r2jf-4vp3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-248"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.1.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Haraka", "source": "cna", "vendor": "haraka"}, "product": "haraka", "vendor": "haraka"}], "analysis": {"en": {"generated_at": "2026-04-02T22:22:06.662884+00:00", "value": {"mitigation_remediation": ["Upgrade Haraka to version 3.1.4 or later", "If an upgrade cannot be performed immediately, monitor inbound email traffic for headers named __proto__ and quarantine or discard such messages", "Configure the mail server\u2019s firewall or SMTP gateway to reject messages that contain the __proto__ header as a temporary mitigation"], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "All installations of the Haraka mail server prior to version 3.1.4 are affected. The vendor is Haraka and the product is Haraka, running on Node.js. Any deployment that uses version 3.1.3 or earlier will be vulnerable.", "description_and_impact": "Haraka servers that receive an email with a header named __proto__ crash the worker process, leading to a denial of service. The flaw arises from improper handling of the header name during parsing. According to CWE-248, this is an off\u2011by\u2011one or similar error that causes the process to terminate, temporarily disabling the mail server until it is restarted. The impact is a loss of availability for all mail that the server receives until a restart occurs.", "risk_and_exploitability": "An attacker can exploit the issue simply by sending an email containing a __proto__ header, a normal part of SMTP traffic. The CVSS score of 8.7 indicates high severity, and because no special privileges are needed the likelihood of exploitation is significant. The vulnerability is not currently listed in the KEV catalog, but the attack vector is remote over the network and would be easily triggered by any mail destined for the server."}}}}, "created": "2026-04-03T07:31:39.817506+00:00", "updated": "2026-04-03T09:16:36.655004+00:00", "vendors": ["haraka", "haraka$PRODUCT$haraka"]}