2026-07a

usememos/memos2026-07aJul 30, 2026by FreddleSpl0it

AI Summary

A security-focused update addressing vulnerabilities in Rspamd and Nginx, hardening CORS settings, and fixing several mail management bugs.

Key Highlights

Updated Rspamd to 4.1.4
Fixed Nginx CVE-2026-42533
Hardened CORS origin matching and security
Fixed subject display in quarantine overview

Full Release Notes

## What's Changed

### Important
This update addresses several security-related issues in mailcow. We strongly recommend updating your mailcow instance as soon as possible.

### Updates and Security
* [Rspamd] update to 4.1.4 by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7386
* Fix nginx CVE-2026-42533 by @SYNLINQ in https://github.com/mailcow/mailcow-dockerized/pull/7358
* Update actions/stale action to v11 by @renovate[bot] in https://github.com/mailcow/mailcow-dockerized/pull/7375
* Hardening mailcow by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7387

### Fixes
* fix: restore subject display in quarantine overview by @oidipos in https://github.com/mailcow/mailcow-dockerized/pull/7367
* [Nginx] only bind IPv6 default_server when ENABLE_IPV6 is set by @smpaz7467 in https://github.com/mailcow/mailcow-dockerized/pull/7343
* [Web] fix add/time_limited_alias silently discarding requests and validity by @smpaz7467 in https://github.com/mailcow/mailcow-dockerized/pull/7345
* [Web] return sender_acl in get/mailbox API by @smpaz7467 in https://github.com/mailcow/mailcow-dockerized/pull/7348
* fix: cors allowed origins settings validation by @fallmo in https://github.com/mailcow/mailcow-dockerized/pull/7333
* [Web] harden CORS origin matching and add Vary: Origin by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7385
* [Web] Move mailcow update check to server side by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7388
* [Web] Create default mailbox template with eas and dav access by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7389
* [ACME] Skip mta-sts certificate request when MTA-STS is not active for a domain by @FreddleSpl0it in https://github.com/mailcow/mailcow-dockerized/pull/7390

## New Contributors
* @oidipos made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/7367
* @smpaz7467 made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/7343
* @fallmo made their first contribution in https://github.com/mailcow/mailcow-dockerized/pull/7333

**Full Changelog**: https://github.com/mailcow/mailcow-dockerized/compare/2026-07...2026-07a