CVE-2026-39971 is an HTTP request/response splitting vulnerability (CWE-113) in Serendipity, a PHP weblog engine. In versions 2.6-beta2 and below, the email sending function inserts the $_SERVER['HTTP_HOST'] value directly into the Message-ID SMTP header without proper validation or sanitization. This allows attackers who can control the Host header during email-triggering actions (such as comment notifications or subscription emails) to inject arbitrary SMTP headers into outgoing emails. The vulnerability enables identity spoofing, reply hijacking via manipulated Message-ID threading, and abuse of email reputation by embedding attacker-controlled domains in legitimate mail headers. The vulnerability is resolved in Serendipity version 2.6.0.

An attacker able to manipulate the HTTP Host header can inject arbitrary SMTP headers into emails sent by Serendipity, leading to identity spoofing, hijacking of email reply threads, and potential damage to email reputation by associating attacker domains with legitimate emails. This can undermine trust in email communications originating from affected Serendipity installations.

Upgrade Serendipity to version 2.6.0 or later, where this vulnerability is fixed. There is no indication of an official patch or temporary workaround for earlier versions. Users running affected versions should prioritize updating to the fixed release to prevent exploitation.