CVE-2026-39971
S9Y Serendipity ≤ 2.6.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NSummary
CVE-2026-39971 is a high-severity HTTP Request/Response Splitting (CWE-113) vulnerability in S9Y Serendipity. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-15 (Information Output Filtering) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-39971 affects Serendipity, a PHP-powered weblog engine, in versions 2.6-beta2 and prior. The vulnerability resides in the email sending functionality within the file include/functions.inc.php, where the $_SERVER['HTTP_HOST'] value is directly inserted into the Message-ID SMTP header without proper validation. Notably, the existing sanitization function serendipity_isResponseClean() is not invoked on the HTTP_HOST value prior to its embedding, allowing untrusted input to propagate into outgoing email headers. The issue is classified under CWE-113 (HTTP response splitting) with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
An unauthenticated attacker (PR:N) can exploit this remotely (AV:N) with low complexity (AC:L) by controlling the Host header during email-triggering actions, such as comment notifications or subscription emails. Successful exploitation enables injection of arbitrary SMTP headers into legitimate outgoing emails from the Serendipity instance. This facilitates identity spoofing, reply hijacking through manipulated Message-ID threading that alters email conversations, and email reputation abuse by embedding the attacker's domain in headers of mail from trusted sources.
The Serendipity project has addressed this vulnerability in version 2.6.0, as detailed in the release notes and corresponding security advisory. Practitioners should upgrade to Serendipity 2.6.0 or later to mitigate the issue. Relevant resources include the GitHub release page at https://github.com/s9y/Serendipity/releases/tag/2.6.0 and the security advisory at https://github.com/s9y/Serendipity/security/advisories/GHSA-458g-q4fh-mj6r.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22811
Vulnerability Data
Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header without validation, and the existing sanitization function serendipity_isResponseClean() is not called on HTTP_HOST before embedding…
more
it. An attacker who can control the Host header during an email-triggering action such as comment notifications or subscription emails can inject arbitrary SMTP headers into outgoing emails. This enables identity spoofing, reply hijacking via manipulated Message-ID threading, and email reputation abuse through the attacker's domain being embedded in legitimate mail headers. This issue has been fixed in version 2.6.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.4.2V4.1.3V1.3.6V4.2.3
Mitigating Controls (NIST 800-53 r5) AI
Input validation stops unneutralized CR/LF characters from being accepted and later emitted in HTTP headers.
Output filtering can neutralize CRLF sequences before they reach HTTP response headers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input sanitization and header handling that prevent CRLF injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect CRLF injection flaws before deployment.
Secure development lifecycle mandates input validation and output encoding that directly prevents CRLF injection into HTTP headers.
Application security requirements explicitly call for controls against injection flaws including HTTP header manipulation.
Secure architecture principles reduce the likelihood of header-splitting vulnerabilities through proper component isolation.
Secure coding standards require neutralization of CRLF sequences before inclusion in HTTP headers.
Logging of HTTP traffic can record header-splitting attempts, aiding detection and forensics.