{"id":"CVE-2021-26090","state":"PUBLISHED","title":"A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote a","description":"A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests.","publishedAt":"2021-07-12T12:53:27.000Z","updatedAt":"2024-10-25T13:55:49.687Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"fortinet"},"assigner":"fortinet","products":["Fortinet Fortinet FortiMail"],"affected":[{"vendor":"Fortinet","product":"Fortinet FortiMail","versions":[{"version":"FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6","status":"affected"}]}],"references":["https://fortiguard.com/advisory/FG-IR-21-042"],"weaknesses":[],"ingestedAt":"2026-10-29T19:48:13.210Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/26xxx/CVE-2021-26090.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-26090","state":"PUBLISHED","datePublished":"2021-07-12T12:53:27.000Z","dateUpdated":"2024-10-25T13:55:49.687Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2021-01-25T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests."}],"affected":[{"vendor":"Fortinet","product":"Fortinet FortiMail","versions":[{"version":"FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6","status":"affected"}]}],"references":[{"url":"https://fortiguard.com/advisory/FG-IR-21-042","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}}],"problemTypes":[{"descriptions":[{"description":"Denial of service","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"fortinet","dateUpdated":"2021-07-12T12:53:27.000Z","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@fortinet.com","ID":"CVE-2021-26090","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Fortinet FortiMail","version":{"version_data":[{"version_value":"FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6"}]}}]},"vendor_name":"Fortinet"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests."}]},"impact":{"cvss":{"attackComplexity":"Low","attackVector":"Network","availabilityImpact":"Low","baseScore":5.3,"baseSeverity":"Medium","confidentialityImpact":"None","integrityImpact":"None","privilegesRequired":"None","scope":"Unchanged","userInteraction":"None","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Denial of service"}]}]},"references":{"reference_data":[{"name":"https://fortiguard.com/advisory/FG-IR-21-042","refsource":"CONFIRM","url":"https://fortiguard.com/advisory/FG-IR-21-042"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/advisory/FG-IR-21-042","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T20:19:19.779Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-23T14:16:13.002885Z","id":"CVE-2021-26090","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-25T13:55:49.687Z"}}]}}}