Starstruk Logo MarkStarstruk

2026-07a

electroplix/Design-System2026-07aJul 30, 2026by FreddleSpl0it

AI Summary

This release prioritizes security hardening, including updates to Rspamd and Nginx to address specific CVEs, alongside various bug fixes for the web interface and mail processing.

Key Highlights

  • Updates Rspamd to version 4.1.4 and fixes a critical Nginx CVE
  • Hardens CORS origin matching and moves update checks to the server side
  • Fixes display issues in quarantine and improves IPv6 binding logic
  • Adds default mailbox templates with EAS and DAV access

New Features

  • Adds default mailbox templates with EAS and DAV access

Full Release Notes

## What's Changed

### Important
This update addresses several security-related issues in mailcow. We strongly recommend updating your mailcow instance as soon as possible.

### Updates and Security
* [Rspamd] update to 4.1.4 by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7386
* Fix nginx CVE-2026-42533 by @SYNLINQ in https://github.com/mailcow/mailcow-dockerized/pull/7358
* Update actions/stale action to v11 by @renovate[bot] in https://github.com/mailcow/mailcow-dockerized/pull/7375
* Hardening mailcow by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7387

### Fixes
* fix: restore subject display in quarantine overview by @oidipos in https://github.com/mailcow/mailcow-dockerized/pull/7367
* [Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set by @smpaz7467 in https://github.com/mailcow/mailcow-dockerized/pull/7343
* [Web] fix add/time_limited_alias silently discarding requests and validity by @smpaz7467 in https://github.com/mailcow/mailcow-dockerized/pull/7345
* [Web] return sender_acl in get/mailbox API by @smpaz7467 in https://github.com/mailcow/mailcow-dockerized/pull/7348
* fix: cors allowed origins settings validation by @fallmo in https://github.com/mailcow/mailcow-dockerized/pull/7333
* [Web] harden CORS origin matching and add Vary: Origin by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7385
* [Web] Move mailcow update check to server side by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7388
* [Web] Create default mailbox template with eas and dav access by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7389
* [ACME] Skip mta-sts certificate request when MTA-STS is not active for a domain by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7390

## New Contributors
* @oidipos made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/7367
* @smpaz7467 made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/7343
* @fallmo made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/7333

**Full Changelog**: https://github.com/mailcow/mailcow-dockerized/compare/2026-07...2026-07a