Posts
-
CVE-2026-40193: LDAP filter injection in maddy
A deep dive into the unsanitized-username LDAP injection we reported in foxcpp/maddy — including the two-path timing side-channel that turns every SMTP AUTH response into an oracle.
A deep dive into the unsanitized-username LDAP injection we reported in foxcpp/maddy — including the two-path timing side-channel that turns every SMTP AUTH response into an oracle.