ZSA-2026-08

Date: 2026-05-27
Affected: All versions of Znuny LTS from 6.5.1 up to including 6.5.20.
All versions of Znuny from 7.3.1 up to including 7.3.2.
All versions of Znuny 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1, and 7.2.
Severity: medium
CVE: CVE-2025-26843

A Denial of Service (DoS) vulnerability exists in the template generator of Znuny. When replacing tags in a template, specially crafted input can cause the tag replacement routine to enter an infinite loop. This leads to excessive CPU and memory consumption and can render the affected system unresponsive.

Fixed in: Znuny LTS 6.5.21 and Znuny 7.3.3