CVE-2005-1348: MailEnable HTTPMail buffer overflow via long Authorization header

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution with a very high EPSS score and public exploit code, though the product versions are long outdated and no KEV listing exists.

What it is

MailEnable Enterprise 1.04 and earlier and Professional 1.54 and earlier contain a buffer overflow in the HTTPMail component, triggered by an overly long HTTP Authorization header. A remote, unauthenticated attacker can send a crafted request to corrupt memory and potentially execute arbitrary code on the mail server.

Impact

Successful exploitation allows remote code execution in the context of the MailEnable service, giving an attacker control over the mail server and any data or credentials it handles. A crash of the HTTPMail service is the minimum outcome.

Attack surface

Reachable over the network through the HTTPMail service's HTTP interface; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The attacker only needs to send a request with a long Authorization header.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.726, 99.4th percentile), and a public proof-of-concept script is referenced, indicating exploit code has circulated.

What to do

• Upgrade MailEnable Enterprise and Professional to versions later than 1.04 and 1.54 respectively, or to a currently supported release.
• If immediate upgrade is not possible, restrict network access to the HTTPMail service to trusted hosts and block it from the public internet.
• Enforce strict HTTP header length limits at a reverse proxy or WAF in front of the mail server.
• Run the MailEnable service with least privilege and isolate it from other critical systems.
• Monitor vendor advisories for this product line and apply subsequent security fixes promptly.

Detection

• Inspect HTTPMail access logs for requests with abnormally long Authorization headers or malformed HTTP requests.
• Alert on crashes or restarts of the MailEnable HTTPMail service, which may indicate exploitation attempts.
• Use network IDS signatures for HTTP Authorization header overflow attempts against MailEnable.
• Hunt for unexpected child processes or outbound connections originating from the MailEnable service account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.