Description
fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | fetchmail | 6.3.1-1 | — |
| Debian 13 | fetchmail | 6.3.1-1 | — |
| Debian 12 | fetchmail | 6.3.1-1 | — |
| Debian 3.1 | fetchmail | 6.2.5-12sarge4 | DSA-939-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | fetchmail | 6.2.5-6.el4.5 | RHSA-2007:0018 |
| RHEL 3 | fetchmail | 6.2.0-3.el3.3 | RHSA-2007:0018 |
| RHEL 2 | fetchmail +1 | 5.9.0-21.7.3.el2.1.4 | RHSA-2007:0018 |
Advisories 2
- RHSA-2007:0018 Red Hat Security Advisory: fetchmail security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-939-1 fetchmail - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- 18266 third-party-advisory
- 18172 third-party-advisory
- 18231 third-party-advisory
- ADV-2006-3101 vdb-entry
- 20051221 fetchmail security announcement fetchmail-SA-2005-03 (CVE-2005-4348) mailing-list
- 21253 third-party-advisory
- 1015383 vdb-entry
- SSA:2006-045-01 vendor-advisory
- 17891 third-party-advisory
- 19289 vdb-entry
- 2006-0002 vendor-advisory
- 18463 third-party-advisory
- 24284 third-party-advisory
- 24007 third-party-advisory
- oval:org.mitre.oval:def:9659 vdb-entry signature
- 15987 vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=343836
- fetchmail-null-pointer-dos(23713) vdb-entry
- SUSE-SR:2007:004 vendor-advisory
- USN-233-1 vendor-advisory
- 21906 vdb-entry
- ADV-2005-2996 vdb-entry
- MDKSA-2005:236 vendor-advisory
- 20060526 rPSA-2006-0084-1 fetchmail mailing-list
- RHSA-2007:0018 vendor-advisory
- 18895 third-party-advisory
- DSA-939 vendor-advisory
- 18433 third-party-advisory
- http://fetchmail.berlios.de/fetchmail-SA-2005-03.txt