Description
Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mutt | 1.5.21-5 | — |
| Debian 13 | mutt | 1.5.21-5 | — |
| Debian 12 | mutt | 1.5.21-5 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | mutt | 5:1.5.20-2.20091214hg736b6a.el6_1.1 | RHSA-2011:0959 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | mutt | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | mutt | No fix yet | — |
Advisories 1
- RHSA-2011:0959 Red Hat Security Advisory: mutt security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2011:0959 vendor-advisory
- 44937 third-party-advisory
- 8143 third-party-advisory
- mutt-smtptls-weak-security(66015) vdb-entry
- 20110308 Mutt: failure to check server certificate in SMTP TLS connection mailing-list
- FEDORA-2011-7751 vendor-advisory
- FEDORA-2011-7739 vendor-advisory
- FEDORA-2011-7756 vendor-advisory
- 46803 vdb-entry