Description
dkim-milter 2.6.0 through 2.8.0 allows remote attackers to cause a denial of service (crash) by signing a message with a key that has been revoked in DNS, which triggers an assertion error.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | dkim-milter | 2.6.0.dfsg-1+lenny1 | DSA-1728-1 |
Advisories 1
- DSA-1728-1 dkim-milter - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- 34053 third-party-advisory
- DSA-1728 vendor-advisory
- 33337 vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=654247
- http://sourceforge.net/tracker/index.php?func=detail&aid=2508602&group_id=139420&atid=744358
- [oss-security] 20090302 CVE id request: dkim-milter mailing-list
- dkimmilter-p-dos(48085) vdb-entry
- 33581 third-party-advisory