{"id":"GO-2026-5137","revision":"497f5102061d4ed8b0d03d76e1ce8fa6","records":[{"revision":"497f5102061d4ed8b0d03d76e1ce8fa6","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5137","aliases":["CVE-2026-40193","GHSA-5835-4gvc-32pc"],"title":"Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username in github.com/foxcpp/maddy","description":"Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username in github.com/foxcpp/maddy","state":0,"publishedAt":"2026-06-25T18:26:48+00:00","modifiedAt":"2026-06-25T18:45:26.6992351+00:00","affected":[{"ecosystem":"Go","name":"github.com/foxcpp/maddy","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.9.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc","https://nvd.nist.gov/vuln/detail/CVE-2026-40193","https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba","https://github.com/foxcpp/maddy/releases/tag/v0.9.3"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5137","license":"OSV · upstream source license applies","key":"osv:GO-2026-5137","identifiers":["GO-2026-5137","CVE-2026-40193","GHSA-5835-4gvc-32pc"]},"retained":false,"historicalAffected":[]}],"coverage":[]}