CVE-2009-1490
Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of...
CVE-2009-1490 is a medium vulnerability (CVSS 5.0) in Sendmail, published May 5, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.6%, the 96th percentile. Fixed in sendmail 8.13.2-0.
Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long X- header, as demonstrated by an X-Testing header.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long X- header, as demonstrated by an X-Testing header.
- Record
CVE-2009-1490- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long X- header, as demonstrated by an X-Testing header.
- Record
CVE-2009-1490- Updated
- 2026-11-02
EUVDEUVD-2009-1487 No score
Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long X- header, as demonstrated by an X-Testing header.
- Record
EUVD-2009-1487- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qhrf-mg36-grcm No score
Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of...
Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long X- header, as demonstrated by an X-Testing header.
- Record
GHSA-qhrf-mg36-grcm- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long X- header, as demonstrated by an X-Testing header.
- Record
CVE-2009-1490- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-1490 No score
Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long X- header, as demonstrated by an X-Testing header.
- Record
DEBIAN-CVE-2009-1490- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Sendmail 8.12.x - 'X-header' Remote Heap Buffer Overflow (PoC) | 2009-05-27 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |