# CVE-2026-48187: OTRS uncontrolled resource consumption in e-mail handling

Source: https://junglewise.ai/threats/cve-2026-48187-otrs-uncontrolled-resource-consumption-in-e-mail-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-48187 · Severity: medium · CVSS 5.7 · Published 2026-06-01

OTRS is a service management and ticketing platform used for customer support and IT service management. A vulnerability in how the system handles incoming emails allows for excessive resource consumption, which can cause the web server to crash. This could lead to a service outage, preventing staff from accessing tickets or responding to customer inquiries.

Technologies: [OTRS AG OTRS Community Edition](https://junglewise.ai/threats/technologies/otrs-community-edition). Vendors: [OTRS AG](https://junglewise.ai/threats/vendors/otrs-ag).

## Quick answers

**Is CVE-2026-48187 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48187 being exploited in the wild.

**How severe is CVE-2026-48187?** Medium severity, with a CVSS score of 5.7, published 1 June 2026.

**Which products and versions are affected?** OTRS AG OTRS Community Edition 6.x, 7.x.

**Is there a fix for CVE-2026-48187?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48187 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-48187?** Check whether you run OTRS AG OTRS Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource exhaustion vulnerability (CWE-400/CWE-770) exists in the email handling component of OTRS. The system fails to properly limit or throttle resource allocation during the processing of emails, allowing an attacker to trigger excessive memory or CPU usage. Exploitation requires network reachability and low-privileged authentication, along with minimal user interaction. Successful exploitation results in the abortion of the web server process, leading to a denial-of-service. The issue is fixed in version 2026.4.X and later.

## Affected products

- OTRS AG OTRS 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.4.X
- OTRS AG OTRS Community Edition 6.x, 7.x

## Timeline

- 2026-06-01: disclosed
- 2026-06-01: advisory

## References

- [https://otrs.com/release-notes/otrs-security-advisory-2026-06/](https://otrs.com/release-notes/otrs-security-advisory-2026-06/)

## Related threats

- [OTRS reflected cross-site scripting in ticket handling](https://junglewise.ai/threats/cve-2026-48209-otrs-reflected-cross-site-scripting-in-ticket-handling)
- [OTRS improper neutralization of SVG content in ticket rendering](https://junglewise.ai/threats/cve-2026-48208-otrs-improper-neutralization-of-svg-content-in-ticket-rendering)
- [OTRS SQL injection in database layer module](https://junglewise.ai/threats/cve-2026-48188-otrs-sql-injection-in-database-layer-module)