CVE-2026-108121: medium-severity vulnerability in Koozali SME Server
Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.3%
Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's
SME Server version 11.0rc1-215, allowing an attacker with high privileges
to inject reserved Apache configuration directives, corrupting
httpd.conf and preventing Apache from starting after a server reboot,
resulting in a denial-of-service (DoS) condition affecting the web
server and its hosted virtual hosts.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:P/S:P/AU:Y/R:A/RE:M/U:Amber
Affected products
Koozali · SME Server