CVE-2026-39971 is an HTTP request/response splitting vulnerability (CWE-113) in Serendipity weblog engine versions before 2.6.0. The email sending function in include/functions.inc.php uses the $_SERVER['HTTP_HOST'] value directly in the SMTP Message-ID header without applying the sanitization function serendipity_isResponseClean(). An attacker able to manipulate the Host header during email-triggering events (e.g., comment notifications) can inject arbitrary SMTP headers into outgoing emails. This can lead to identity spoofing, reply hijacking through manipulated Message-ID threading, and email reputation abuse by inserting attacker-controlled domains into email headers. The vulnerability has been addressed in version 2.6.0.

An attacker controlling the Host header can inject arbitrary SMTP headers into emails sent by Serendipity, enabling identity spoofing and reply hijacking. This can undermine email trust and reputation by associating attacker domains with legitimate emails. There is no indication of direct system compromise or denial of service. The CVSS score of 7.2 reflects a high severity with network attack vector, no privileges required, no user interaction, and partial confidentiality and integrity impact.

Upgrade Serendipity to version 2.6.0 or later, where this vulnerability is fixed. Since the vendor advisory confirms the issue is resolved in 2.6.0, applying this official fix is the recommended remediation. No other mitigations are specified or required.