Skip to main content

Mutt CVE-2026-43861

| EUVDEUVD-2026-26899 LOW
Improper Neutralization of Null Byte or NUL Character (CWE-158)
2026-05-04 mitre
Information Disclosure Mutt
3.7
CVSS 3.1 · NVD

Severity by source

NVD PRIMARY
3.7 LOW
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

7
Patch available
May 04, 2026 - 07:31 EUVD
Source Code Evidence Fetched
May 04, 2026 - 07:30 vuln.today
Analysis Generated
May 04, 2026 - 07:30 vuln.today
Patch released
May 04, 2026 - 07:16 nvd
Patch available
EUVD ID Assigned
May 04, 2026 - 07:00 euvd
EUVD-2026-26899
Analysis Generated
May 04, 2026 - 07:00 vuln.today
CVE Published
May 04, 2026 - 05:52 nvd
LOW 3.7

DescriptionCVE.org

mutt before 2.3.2 does not check for '\0' in url_pct_decode.

AnalysisAI

mutt before version 2.3.2 fails to validate null bytes during URL percent-decoding, allowing remote attackers to inject embedded null characters into decoded URLs, potentially causing information disclosure through truncation of validation checks or bypassing of security filters that rely on string length.

More in Mutt

View all
CVE-2018-14362 CRITICAL
9.8 Jul 17

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Rated critical severity (CVSS 9.8), this vu
CVE-2018-14359 CRITICAL
9.8 Jul 17

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Rated critical severity (CVSS 9.8), this vu
CVE-2018-14358 CRITICAL
9.8 Jul 17

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Rated critical severity (CVSS 9.8), this vu
CVE-2018-14357 CRITICAL
9.8 Jul 17

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Rated critical severity (CVSS 9.8), this vu
CVE-2018-14356 CRITICAL
9.8 Jul 17

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Rated critical severity (CVSS 9.8), this vu
CVE-2018-14354 CRITICAL
9.8 Jul 17

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Rated critical severity (CVSS 9.8), this vu
CVE-2018-14353 CRITICAL
9.8 Jul 17

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Rated critical severity (CVSS 9.8), this vu
CVE-2018-14352 CRITICAL
9.8 Jul 17

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Rated critical severity (CVSS 9.8), this vu
CVE-2018-14351 CRITICAL
9.8 Jul 17

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Rated critical severity (CVSS 9.8), this vu
CVE-2018-14350 CRITICAL
9.8 Jul 17

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Rated critical severity (CVSS 9.8), this vu
CVE-2018-14349 CRITICAL
9.8 Jul 17

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. Rated critical severity (CVSS 9.8), this vu
CVE-2014-9116 MEDIUM POC
5.0 Dec 02

The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, w

Same weakness CWE-158 – Improper Neutralization of Null Byte or NUL Character

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2025-66263 HIGH POC
8.9
CVE-2023-5719 CRITICAL
9.8
CVE-2020-14500 CRITICAL
9.8
CVE-2026-33191 HIGH
8.6
CVE-2024-10921 HIGH
8.1
CVE-2025-1936 HIGH
7.3
CVE-2020-5363 MEDIUM
6.7

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-43861 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy