CVE-2025-40631 - CVE House
Back to Database
Status published Low CVE-2025-40631

HTTP host header injection vulnerability in IceWarp Mail Server

Vulnerability Description

HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-40631

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Julen Garrido Estévez

References

More from Icewarp

View All →
CVE-2025-40632
Cross-site scripting (XSS) vulnerability in IceWarp Mail Server
Low 2
CVE-2025-40630
Open redirection vulnerability in IceWarp Mail Server
Medium 5.1

Affected Vendor

Affected Software

Icewarp Mail Server
Vulnerable Versions:
11.4.0

Timeline

Official Publish: May 16th, 2025
Last Modified: May 16th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-644

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.