Is CVE-2026-39971 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39971 being exploited in the wild.

How severe is CVE-2026-39971?

High severity, with a CVSS score of 7.2, published 15 April 2026.

Which products and versions are affected?

s9y/serendipity (Packagist) < 2.6.0, ECOSYSTEM:introduced=0,fixed=2.6.0.

Is there a fix for CVE-2026-39971?

Yes. s9y/serendipity (Packagist): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2026-39971?

Check whether you run s9y/serendipity (Packagist) or S9y Serendipity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39971: Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header

Q: Is there a fix for CVE-2026-39971?

Yes. s9y/serendipity (Packagist): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: Am I affected by CVE-2026-39971?

Check whether you run s9y/serendipity (Packagist) or S9y Serendipity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39971 · Severity: high · CVSS 7.2 · Published 2026-04-15

Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header without validation, and the existing sanitization function serendipity_isResponseClean() is not called on HTTP_HOST before embedding it. An attacker who can control the Host header during an email-triggering action such as comment notifications or subscription emails can inject arbitrary SMTP headers into outgoing emails. This enables identity spoofing, reply hijacking via manipulated Message-ID threading, and email reputation abuse through the attacker's domain being embedded in legitimate mail headers. This issue has been fixed in version 2.6.0.

Technologies: S9y Serendipity. Vendors: Packagist, S9y.

Quick answers

Is CVE-2026-39971 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39971 being exploited in the wild.
How severe is CVE-2026-39971?: High severity, with a CVSS score of 7.2, published 15 April 2026.
Which products and versions are affected?: s9y/serendipity (Packagist) < 2.6.0, ECOSYSTEM:introduced=0,fixed=2.6.0.
Is there a fix for CVE-2026-39971?: Yes. s9y/serendipity (Packagist): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-39971?: Check whether you run s9y/serendipity (Packagist) or S9y Serendipity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

s9y/serendipity (Packagist): upgrade to 2.6.0 or later
```
composer require s9y/serendipity:^2.6.0
```

Affected products

s9y/serendipity (Packagist) < 2.6.0, ECOSYSTEM:introduced=0,fixed=2.6.0
S9y Serendipity

Identifiers

CVE-2026-39971
GHSA-458g-q4fh-mj6r

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.