This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Postfix fixes several vulnerabilities
Postfix fixes several vulnerabilities in versions 3.11.7, 3.10.14, 3.9.15, 3.8.21, 3.7.23, 3.6.21 and 3.5.28 [1].
An unauthenticated remote attacker can carry out a DoS attack by sending SMTP commands with specially crafted e-mail addresses [1].
The vulnerability is present in product:
- Postfix; >=3.11.0, <3.11.7; >=3.10.0, <3.10.14; >=3.9.0, <3.9.15; >=3.8.0, <3.8.21; >=3.7.0, <3.7.23; >=3.6.0, <3.6.21; >=3.5.0, <3.5.28;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CWE-476: NULL Pointer Dereference at cwe.mitre.org
The vulnerability was publicly disclosed 8. 9. 2026.
An unauthenticated remote attacker can smuggle SMTP commands to the server due to faulty proxy filter functionality in the default configuration [1].
The vulnerability is present in product:
- Postfix; >=3.11.0, <3.11.7; >=3.10.0, <3.10.14; >=3.9.0, <3.9.15; >=3.8.0, <3.8.21; >=3.7.0, <3.7.23; >=3.6.0, <3.6.21; >=3.5.0, <3.5.28;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
More information:
- CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') at cwe.mitre.org
- CWE-345: Insufficient Verification of Data Authenticity at cwe.mitre.org
The vulnerability was publicly disclosed 8. 9. 2026.
By CESNET, z.s.p.o. Martin Krajči on 11. 9. 2026.