# CVE-1999-0250: qmail memory exhaustion denial of service via RCPT commands

Source: https://junglewise.ai/threats/cve-1999-0250-qmail-memory-exhaustion-denial-of-service-via-rcpt-commands  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-07-01. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0250 · Severity: critical · CVSS 10 · Published 1997-07-01

A vulnerability in the qmail email server allows a remote attacker to crash the system or make it unresponsive. By sending an excessive number of recipient addresses in a single email transaction, an attacker can exhaust the server's memory and swap space. This results in a total denial of service, preventing the organization from sending or receiving legitimate email and potentially impacting other services on the same host.

## Quick answers

**Is CVE-1999-0250 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0250 being exploited in the wild.

**How severe is CVE-1999-0250?** Critical severity, with a CVSS score of 10, published 1 July 1997.

**Which products and versions are affected?** qmail qmail 1.0 and earlier.

**Is there a fix for CVE-1999-0250?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0250 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-1999-0250?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The qmail-smtpd component fails to impose a configurable upper bound on the number of RCPT commands accepted per message. A remote, unauthenticated attacker can establish an SMTP connection and transmit an infinite stream of 'RCPT TO' commands. Because qmail-smtpd dynamically allocates memory to track these recipients, the process will eventually consume all available physical memory and swap space on the host. This leads to a denial of service (DoS) through resource exhaustion. While the vendor argued that system-level resource limits (rlimits) should be used to mitigate such issues, the lack of application-level enforcement allows for trivial exploitation on default configurations.

## Affected products

- qmail qmail 1.0 and earlier

## Timeline

- 1997-06-11: disclosed: Vulnerability details and proof-of-concept code shared on the qmail mailing list.
- 1997-07-01: advisory: NVD published the CVE record.

## References

- [http://cr.yp.to/qmail/venema.html](http://cr.yp.to/qmail/venema.html)
- [http://marc.info/?l=bugtraq&m=87602558319024&w=2](http://marc.info/?l=bugtraq&m=87602558319024&w=2)
- [http://www.ornl.gov/its/archives/mailing-lists/qmail/1997/06/threads.html](http://www.ornl.gov/its/archives/mailing-lists/qmail/1997/06/threads.html)