Description
Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion, which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sendmail | 8.13.7-1 | — |
| Debian 13 | sendmail | 8.13.7-1 | — |
| Debian 12 | sendmail | 8.13.7-1 | — |
| Debian 3.1 | sendmail | 8.13.4-3sarge2 | DSA-1155 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | sendmail +3 | 8.13.1-3.RHEL4.5 | RHSA-2006:0515 |
| RHEL 3 | sendmail +3 | 8.12.11-4.RHEL3.6 | RHSA-2006:0515 |
Advisories 2
- RHSA-2006:0515 Red Hat Security Advisory: sendmail security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1155 sendmail - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- IY85415 vendor-advisory
- HPSBTU02116 vendor-advisory
- DSA-1155 vendor-advisory
- [3.8] 008: SECURITY FIX: June 15, 2006 vendor-advisory
- 20684 third-party-advisory
- HPSBUX02124 vendor-advisory
- ADV-2006-2388 vdb-entry
- 20726 third-party-advisory
- oval:org.mitre.oval:def:11253 vdb-entry signature
- ADV-2006-2351 vdb-entry
- 21327 third-party-advisory
- RHSA-2006:0515 vendor-advisory
- ADV-2006-2389 vdb-entry
- 21647 third-party-advisory
- http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-18.html
- https://issues.rpath.com/browse/RPL-526
- 20651 third-party-advisory
- 20683 third-party-advisory
- 20650 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-148.htm
- 20782 third-party-advisory
- ADV-2006-3135 vdb-entry
- 1016295 vdb-entry
- 20694 third-party-advisory
- 20473 third-party-advisory
- ADV-2006-2189 vdb-entry
- 20060721 rPSA-2006-0134-1 sendmail sendmail-cf mailing-list
- ADV-2006-2798 vdb-entry
- 102460 vendor-advisory
- http://www.sendmail.com/security/advisories/SA-200605-01.txt.asc
- MDKSA-2006:104 vendor-advisory
- sendmail-multipart-mime-dos(27128) vdb-entry
- 20673 third-party-advisory
- http://www.f-secure.com/security/fsc-2006-5.shtml
- 20060621 Re: Sendmail MIME DoS vulnerability mailing-list
- 21612 third-party-advisory
- 20654 third-party-advisory
- ADV-2006-2390 vdb-entry
- SSA:2006-166-01 vendor-advisory
- GLSA-200606-19 vendor-advisory
- 18433 vdb-entry
- 20675 third-party-advisory
- SUSE-SA:2006:032 vendor-advisory
- 20060620 Sendmail MIME DoS vulnerability mailing-list
- VU#146718 third-party-advisory
- 15779 third-party-advisory
- 20641 third-party-advisory
- 20679 third-party-advisory
- 26197 vdb-entry
- 21042 third-party-advisory
- 21160 third-party-advisory
- IY85930 vendor-advisory
- 20060624 Re: Sendmail MIME DoS vulnerability mailing-list