Zimbra Collaboration Suite Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Zimbra Collaboration Suite (ZCS) versions prior to 9.0.0 Patch 46, 10.0.x prior to 10.0.15, and 10.1.x prior to 10.1.9. The vulnerability arises from improper handling of excessive, comma-separated path segments in both the Webmail interface and the Admin Console. An unauthenticated remote attacker can exploit this issue by sending specially crafted GET requests that cause redundant processing and inflated responses, leading to uncontrolled resource consumption and service disruptions.

Impact

Exploitation of this vulnerability causes uncontrolled resource consumption, resulting in denial-of-service conditions on the affected system.

Remediation

Users can upgrade to ZCS 9.0.0 Patch 46, ZCS 10.0.15, or ZCS 10.1.9, all of which include the necessary patch. Instructions for upgrading can be found on the Zimbra website.