Skip to main content

Postfix EUVDEUVD-2026-27115

| CVE-2026-43964 HIGH
Off-by-one Error (CWE-193)
2026-05-04 mitre
Denial Of Service Postfix
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network-reachable malformed status code with no auth or interaction triggers a crash, so AV:N/AC:L/PR:N/UI:N; impact is availability-only (A:H), with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

9
Analysis Updated
Jun 30, 2026 - 04:25 vuln.today
v5 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 04:25 vuln.today
v4 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 04:25 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 04:22 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 30, 2026 - 03:24 vuln.today
cvss_changed
Severity Changed
Jun 30, 2026 - 03:24 NVD
LOW HIGH
CVSS changed
Jun 30, 2026 - 03:24 NVD
3.7 (LOW) 7.5 (HIGH)
Patch available
May 04, 2026 - 20:01 EUVD
Analysis Generated
May 04, 2026 - 19:30 vuln.today

DescriptionNVD

Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.

AnalysisAI

Remote denial of service in the Postfix mail transfer agent (before 3.8.16, 3.9.x before 3.9.10, and 3.10.x before 3.10.9) lets attackers crash the process through a malformed enhanced status code that ends immediately after the third numeric component with no trailing text, triggering a buffer over-read. The flaw affects availability only - no data exposure or code execution - and has no public exploit identified at time of analysis. EPSS is very low (0.04%, 11th percentile) and CISA SSVC rates exploitation as none and non-automatable, consistent with a crash-only bug.

Technical ContextAI

Postfix is a widely used open-source SMTP mail transfer agent. RFC 3463 enhanced status codes take the form 'class.subject.detail' (three dot-separated numbers) optionally followed by descriptive text. The vulnerability is rooted in CWE-193 (off-by-one error): when Postfix parses an enhanced status code that terminates right after the third number with no following text, the parser reads past the end of the buffer. The single affected CPE is cpe:2.3:a:postfix:postfix, indicating the upstream Postfix codebase itself rather than a downstream wrapper, so all distributions packaging the vulnerable releases inherit the bug.

RemediationAI

Vendor-released patch: upgrade to Postfix 3.8.16, 3.9.10, or 3.10.9 (or later) depending on your branch; these are the fixed releases per the Postfix announcement at https://www.mail-archive.com/postfix-announce@postfix.org/msg00110.html. Red Hat users should apply the distribution updates in RHSA-2026:25930, RHSA-2026:25932, or RHSA-2026:26205 as referenced at https://access.redhat.com/security/cve/CVE-2026-43964. Because the bug is a parser over-read with no configuration toggle to disable it, there is no clean feature-level workaround; as a compensating control while patching, restrict which SMTP peers Postfix talks to by tightening relay/smtp client access and firewalling the SMTP service to trusted networks to reduce exposure to attacker-supplied status codes, accepting the trade-off that this limits legitimate mail connectivity and does not fully eliminate the trigger. Monitor for unexpected smtpd/smtp process restarts as a detection signal.

More in Postfix

View all
CVE-2012-0811 MEDIUM POC
6.5 Oct 01

Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users
CVE-2023-51764 MEDIUM POC
5.3 Dec 24

Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and

CVE-2020-12063 MEDIUM POC
5.3 Apr 24

A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homog

Same weakness CWE-193 – Off-by-one Error

View all
CVE-2021-3156 HIGH POC
7.8
CVE-2022-34970 CRITICAL POC
9.8
CVE-2021-31875 CRITICAL POC
9.8
CVE-2020-8443 CRITICAL POC
9.8
CVE-2019-14532 CRITICAL POC
9.8
CVE-2026-86297 HIGH POC
8.2
CVE-2019-13306 HIGH POC
7.8
CVE-2019-13305 HIGH POC
7.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

Share

EUVD-2026-27115 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy