Junglewise Threat Intelligence

CVE-2026-43964: Postfix buffer over-read in enhanced status code handling

CVE-2026-43964 · Severity: low · CVSS 3.7 · Published 2026-05-04

Technologies: Red Hat Enterprise Linux. Vendors: Red Hat.

Executive brief

Postfix, a widely used mail server responsible for routing and delivering email, is vulnerable to a flaw that can cause the service to crash. An attacker can trigger this by sending specially formatted status codes that the server fails to process correctly. If exploited, this could lead to a disruption in email services, preventing the organization from sending or receiving messages.

Technical details

A buffer over-read vulnerability (CWE-193) exists in Postfix's DSN utility functions. The flaw is triggered when an enhanced status code (e.g., '5.7.2') is provided without any subsequent text, causing the parser to read beyond the allocated buffer. While it cannot be triggered via standard SMTP/LMTP server responses, it can be exploited through DNSBL (DNS Blocklist) TXT responses, access tables, policy server responses, or Milter responses. An attacker controlling a DNSBL server or influencing other lookup mechanisms can cause the Postfix process to terminate, leading to a denial of service. Patches are available in Postfix versions 3.8.16, 3.9.10, and 3.10.9.

Affected products

  • Postfix Postfix 2.3 before 3.8.16, 3.9 before 3.9.10, 3.10 before 3.10.9
  • Red Hat Enterprise Linux 6, 7, 8, 9, 10

Timeline

  • 2026-05-03: patched: Postfix legacy releases 3.10.9, 3.9.10, 3.8.16 released
  • 2026-05-04: disclosed: Public disclosure on oss-security mailing list
  • 2026-05-04: advisory: CVE-2026-43964 assigned
  • 2026-06-15: patched: Red Hat released security updates for RHEL 10

References