This vulnerability (CVE-2026-41873) in Apache Pony Mail's Lua implementation arises from inconsistent parsing of HTTP requests, classified under CWE-444 (HTTP Request/Response Smuggling). Exploitation can result in full compromise of administrative privileges. The Lua version is retired with no planned fixes, and the Python version under development is unaffected. No known exploits are reported in the wild. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to take over administrative accounts, leading to complete compromise of the affected Pony Mail instance. This impacts confidentiality, integrity, and availability of the system. Since the product is retired and unpatched, affected users face ongoing risk if the system remains accessible.

No official fix or patch is available as the Lua implementation is retired. Users should restrict access to the affected Pony Mail instances to trusted users only or migrate to alternative solutions such as the upcoming Python implementation (Pony Mail Foal) once released. Monitoring for suspicious activity is advisable given the critical nature of the vulnerability.