CVE-2026-108121

UNKNOWN 0.0

Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from starting after a server reboot, resulting in a denial-of-service (DoS) condition affecting the web server and its hosted virtual hosts.

CWE	CWE-20 CWE-96 CWE-400
Vendor	koozali
Product	sme server
Published	Oct 19, 2026
Last Updated	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for koozali sme server

Be the first to know when new unknown vulnerabilities affecting koozali sme server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Koozali / SME Server

11.0rc1-215

References

NVD ↗ CVE.org ↗ EPSS Data ↗

digitalcanion.com: https://digitalcanion.com/en/security-research/#vendor=koozali

Credits

Brian Mariani from DigitalCanion SA