Description
The address parser code in Postfix 1.1.12 and earlier allows remote attackers to cause a denial of service (lock) via (1) a malformed envelope address to a local host that would generate a bounce and contains the ".!" string in the MAIL FROM or Errors-To headers, which causes nqmgr to lock up, or (2) via a valid MAIL FROM with a RCPT TO containing a ".!" string, which causes an instance of the SMTP listener to lock up.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | postfix | 1.1.12 | — |
| Debian 13 | postfix | 1.1.12 | — |
| Debian 12 | postfix | 1.1.12 | — |
| Debian 3.0 | postfix | 1.1.11-0.woody3 | DSA-363 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- Postfix 1.1.x - Denial of Service (1) EDB-22981 · dos · Aug 4, 2003 · verified
- Postfix 1.1.x - Denial of Service (2) EDB-22982 · dos · Aug 4, 2003 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-363 postfix - denial of service, bounce-scanning Debian Security (DSA / DLA) · Mar 9, 2026
References
- CLA-2003:717 vendor-advisory
- 8333 vdb-entry
- 20030804 Postfix 1.1.12 remote DoS / Postfix 1.1.11 bounce scanning mailing-list
- VU#895508 third-party-advisory
- 2003-0029 vendor-advisory
- MDKSA-2003:081 vendor-advisory
- RHSA-2003:251 vendor-advisory
- DSA-363 vendor-advisory
- 20030804 Postfix 1.1.12 remote DoS / Postfix 1.1.11 bounce scanning mailing-list
- ESA-20030804-019 vendor-advisory
- SuSE-SA:2003:033 vendor-advisory
- oval:org.mitre.oval:def:544 vdb-entry signature
- 9433 third-party-advisory