CVE-2026-50878: An issue in the attachment handling component of Feuerhamster MailForm v1

Synopsis

A denial-of-service vulnerability exists in the attachment handling component of Feuerhamster MailForm v1.1.0. The flaw is reachable over the network without any authentication, and an attacker can trigger it by sending a crafted request to the affected endpoint. Successful exploitation crashes or renders the MailForm service unavailable. No fix version has been published yet; HarborGuard tracks this advisory and will surface a patched rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable attachment handling endpoint is exposed over the network, so an attacker must be able to reach it via HTTP or any other transport the service listens on.

• AuthenticationNot required

  No account or credential is needed; the crafted request can be sent anonymously.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the request alone is sufficient to trigger the denial of service.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race conditions, memory layout requirements, or environmental factors need to align for the attack to succeed.

Blast Radius

• The MailForm service becomes unresponsive or crashes, preventing legitimate users from submitting contact or inquiry forms.
• Depending on deployment topology, a sustained stream of crafted requests keeps the service down for the duration of the attack.
• If MailForm runs in a shared container alongside other application components, resource exhaustion may degrade or disrupt neighboring processes.