Description
Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Postfix Postfix
Default version status: unaffected
2.3 to < 3.8.16affected3.9 to < 3.9.10affected3.10 to < 3.10.9affected
References
- https://www.mail-archive.com/postfix-announce@postfix.org/msg00110.html ↗
- http://www.openwall.com/lists/oss-security/2026/05/04/30 ↗
- https://access.redhat.com/security/cve/CVE-2026-43964 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2466488 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43964.json ↗
- https://access.redhat.com/errata/RHSA-2026:57174 ↗
- https://access.redhat.com/errata/RHSA-2026:51436 ↗
- https://access.redhat.com/errata/RHSA-2026:25930 ↗
- https://access.redhat.com/errata/RHSA-2026:25932 ↗
- https://access.redhat.com/errata/RHSA-2026:26205 ↗
- https://access.redhat.com/errata/RHSA-2026:51034 ↗
- https://access.redhat.com/errata/RHSA-2026:50963 ↗
- https://access.redhat.com/errata/RHSA-2026:50964 ↗