Pre-authentication upload parsing permits resource exhaustion

Summary

SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with concurrent or slow requests, causing service unavailability.

Remediation

1. Inventory every SEPPmail AG SEPPmail Secure Email Gateway (SEG) deployment, including staging.
2. Upgrade SEPPmail AG SEPPmail Secure Email Gateway (SEG) to 15.1.1.
3. Confirm the running version after the upgrade.

References

• Referencehttps://docs.seppmail.com/en/20_revision-history.html