Description
nullmailer 1.00RC5 and earlier allows local users to cause a denial of service via an email to a local user that does not exist, which generates an error that causes nullmailer to stop sending mail to all users.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nullmailer | 1.00RC5-17 | — |
| Debian 13 | nullmailer | 1.00RC5-17 | — |
| Debian 12 | nullmailer | 1.00RC5-17 | — |
| Debian 3.0 | nullmailer | 1.00RC5-16.1woody2 | DSA-198 |
Advisories 1
- DSA-198 nullmailer - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-198 vendor-advisory
- 6193 vdb-entry
- nullmailer-nonexistent-user-dos(10649) vdb-entry