Every CVE Search/ Get API key

CVE-2024-49394

Mutt: neomutt: in-reply-to email header field it not protected by cryptograpic signing

5.3 MediumFix available

In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.33%Up 0.3 points since Nov 12, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.3

Mutt: neomutt: in-reply-to email header field it not protected by cryptograpic signing

In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.

Record
CVE-2024-49394
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-347
Updated
2026-11-06
EUVDEUVD-2024-43421 5.3

In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.

Record
EUVD-2024-43421
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-06
GitHub AdvisoriesGHSA-q998-8jff-x3rg 5.3

In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing...

In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.

Record
GHSA-q998-8jff-x3rg
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-347
Updated
2026-11-02
NVD 5.3

In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.

Record
CVE-2024-49394
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-347
Updated
2026-11-06
OSV 5.3

In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.

Record
CVE-2024-49394
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2024-49394 5.3

In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.

Record
DEBIAN-CVE-2024-49394
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-07
Show 6 moreShow less
OSVUBUNTU-CVE-2024-49394 5.3

In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.

Record
UBUNTU-CVE-2024-49394
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVCLSA-2026-1783434809 No score

mutt: Fix of CVE-2024-49394

  • CVE-2024-49394: fix In-Reply-To and References headers not being copied into protected headers
Record
CLSA-2026-1783434809
Updated
2026-11-02
OSVCLSA-2026-1783436433 No score

mutt: Fix of CVE-2024-49394

  • CVE-2024-49394: protect In-Reply-To and References under the cryptographic signature (add to protected headers)
Record
CLSA-2026-1783436433
Updated
2026-11-02
OSVMGASA-2025-0070 No score

Updated neomutt packages fix security vulnerabilities

The To and Cc email header fields are not protected by cryptographic signing. (CVE-2024-49393) The In-reply-to email header field is not protected by cryptographic signing. (CVE-2024-49394)

Record
MGASA-2025-0070
Updated
2026-11-02
OSVopenSUSE-SU-2024:14527-1 No score

neomutt-20241114-1.1 on GA media

These are all security issues fixed in the neomutt-20241114-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14527-1
Updated
2026-11-02
OSVUSN-7204-1 No score

neomutt vulnerabilities

Jeriko One discovered that NeoMutt incorrectly handled certain IMAP and POP3 responses. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in a denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14349, CVE-2018-14350, CVE-2018-14351, CVE-2018-14352, CVE-2018-14353, CVE-2018-14354, CVE-2018-14355, CVE-2018-14356, CVE-2018-14357, CVE-2018-14358, CVE-2018-14359, CVE-2018-14362)

Jeriko One discovered that NeoMutt incorrectly handled certain NNTP-related operations. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service, or the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14360, CVE-2018-14361, CVE-2018-14363)

It was discovered that NeoMutt incorrectly processed additional data when communicating with mail servers. An attacker could possibly use this issue to access senstive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14954, CVE-2020-28896)

It was discovered that Neomutt incorrectly handled the IMAP QRSync setting. An attacker could possibly use this issue to cause NeoMutt to crash, resulting in denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-32055)

Tavis Ormandy discovered that NeoMutt incorrectly parsed uuencoded text past the length of the string. An attacker could possibly use this issue to enable the execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1328)

It was discovered that NeoMutt did not properly encrypt email headers. An attacker could possibly use this issue to receive emails that were not intended for them and access sensitive information. This vulnerability was only fixed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-49393, CVE-2024-49394)

Record
USN-7204-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mutt
TuxCare:AlmaLinux:9.2
 before 5:2.2.6-1.el9_2.tuxcare.els3
5:2.2.6-1.el9_2.tuxcare.els3
mutt
TuxCare:AlmaLinux:9.6
 before 5:2.2.6-2.el9_6.tuxcare.els1
5:2.2.6-2.el9_6.tuxcare.els1
mutt
Debian:12
 All versions, plus listed versions
2.2.12-0.12.2.12-0.1~deb12u12.2.13-12.2.9-12.2.9-1+deb12u1
Show 4 moreShow less
2.3.2-12.4.0-12.4.1-12.4.1-1.1
 None known
mutt
Debian:13
 All versions, plus listed versions
2.2.13-12.2.13-1+deb13u12.2.13-1+deb13u22.3.2-12.4.0-12.4.1-12.4.1-1.1
 None known
mutt
Debian:14
 All versions, plus listed versions
2.2.13-12.3.2-12.4.0-12.4.1-12.4.1-1.1
 None known
neomutt
Debian:12
 All versions, plus listed versions
20220429+dfsg1-4.120231103+dfsg1-120240425+dfsg-120240425+dfsg-220241002+dfsg-1
Show 23 moreShow less
20241002+dfsg-1~bpo12+120241114+dfsg-120241114+dfsg1-120241212+dfsg-120241212+dfsg-220250109+dfsg-120250113+dfsg-120250113+dfsg-1~bpo12+120250404+dfsg-120250404+dfsg-1~bpo12+120250404+dfsg-220250404+dfsg-2~bpo12+120250404+dfsg-2~bpo12+220250510+dfsg-120250510+dfsg-220250510+dfsg-2~bpo12+120250905+dfsg-120251211+dfsg-120260105+dfsg-120260105+dfsg-1~bpo13+120260406+dfsg-120260504+dfsg-120260616+dfsg-1
 None known
neomutt
Debian:13
 before 20241002+dfsg-1
20241002+dfsg-1
neomutt
Debian:14
 before 20241002+dfsg-1
20241002+dfsg-1
neomutt
Mageia:9
From an advisory covering 2 CVEs
 before 20241002-1.mga9
20241002-1.mga9
mutt
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.5.23-3.1ubuntu11.5.23-3.1ubuntu21.5.24-11.5.24-1build11.5.24-1ubuntu0.1
Show 7 moreShow less
1.5.24-1ubuntu0.21.5.24-1ubuntu0.31.5.24-1ubuntu0.41.5.24-1ubuntu0.51.5.24-1ubuntu0.61.5.24-1ubuntu0.6+esm21.5.24-1ubuntu0.6+esm3
 None known
Show 16 moreShow less
Affected packages
PackageAffectedFixed
mutt
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.8.3+neomutt20170609-2build11.9.1-21.9.1-31.9.1-41.9.1-5
Show 11 moreShow less
1.9.2-11.9.3-11.9.4-21.9.4-31.9.4-3ubuntu0.11.9.4-3ubuntu0.21.9.4-3ubuntu0.31.9.4-3ubuntu0.41.9.4-3ubuntu0.51.9.4-3ubuntu0.61.9.4-3ubuntu0.6+esm1
 None known
neomutt
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
20171027-120171027-220171027+dfsg.1-120171027+dfsg.1-220171027+dfsg.1-4
Show 4 moreShow less
20171208+dfsg.1-120171208+dfsg.1-220171215+dfsg.1-120171215+dfsg.1-1ubuntu0.1~esm1
 None known
mutt
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.10.1-2.11.12.2-11.12.2-21.13.0-11.13.2-1
Show 6 moreShow less
1.13.2-1ubuntu0.11.13.2-1ubuntu0.21.13.2-1ubuntu0.31.13.2-1ubuntu0.41.13.2-1ubuntu0.51.13.2-1ubuntu0.6
 None known
neomutt
Ubuntu:Pro:20.04:LTS
 before 20191207+dfsg.1-1.1ubuntu0.1~esm1, plus listed versions
20180716+dfsg.1-1.220191111+dfsg.1-120191207+dfsg.1-1.1
20191207+dfsg.1-1.1ubuntu0.1~esm1
mutt
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.0.5-4.1build12.1.3-12.1.4-12.1.4-1build12.1.4-1ubuntu1.12.1.4-1ubuntu1.2
 None known
neomutt
Ubuntu:Pro:22.04:LTS
 before 20211029+dfsg1-1ubuntu0.1~esm1, plus listed versions
20201127+dfsg.1-1.220211029+dfsg1-1
20211029+dfsg1-1ubuntu0.1~esm1
mutt
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.2.9-12.2.9-1ubuntu0.23.10.12.2.12-0.12.2.12-0.1build22.2.12-0.1build32.2.12-0.1build4
 None known
neomutt
Ubuntu:Pro:24.04:LTS
 before 20231103+dfsg1-1ubuntu0.1~esm1, plus listed versions
20220429+dfsg1-4.120231103+dfsg1-120231103+dfsg1-1build220231103+dfsg1-1build3
20231103+dfsg1-1ubuntu0.1~esm1
mutt
Ubuntu:25.10
 All versions, plus listed versions
2.2.13-1
 None known
mutt
Ubuntu:26.10
 All versions, plus listed versions
2.2.13-1build22.3.2-12.4.0-12.4.1-1
 None known
mutt
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.2.13-12.2.13-1build12.2.13-1build2
 None known
neomutt
Ubuntu:Pro:18.04:LTS
From an advisory covering 21 CVEs
 before 20171215+dfsg.1-1ubuntu0.1~esm1, plus listed versions
20171027-120171027-220171027+dfsg.1-120171027+dfsg.1-220171027+dfsg.1-420171208+dfsg.1-120171208+dfsg.1-220171215+dfsg.1-1
20171215+dfsg.1-1ubuntu0.1~esm1
neomutt
Ubuntu:Pro:20.04:LTS
From an advisory covering 21 CVEs
 before 20191207+dfsg.1-1.1ubuntu0.1~esm1, plus listed versions
20180716+dfsg.1-1.220191111+dfsg.1-120191207+dfsg.1-1.1
20191207+dfsg.1-1.1ubuntu0.1~esm1
neomutt
Ubuntu:Pro:22.04:LTS
From an advisory covering 21 CVEs
 before 20211029+dfsg1-1ubuntu0.1~esm1, plus listed versions
20201127+dfsg.1-1.220211029+dfsg1-1
20211029+dfsg1-1ubuntu0.1~esm1
neomutt
Ubuntu:Pro:24.04:LTS
From an advisory covering 21 CVEs
 before 20231103+dfsg1-1ubuntu0.1~esm1, plus listed versions
20220429+dfsg1-4.120231103+dfsg1-120231103+dfsg1-1build220231103+dfsg1-1build3
20231103+dfsg1-1ubuntu0.1~esm1
neomutt
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 20241114-1.1
20241114-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-49394 is a medium vulnerability (CVSS 5.3) in Mutt, published November 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in mutt 5:2.2.6-1.el9_2.tuxcare.els3.

References

Show 36 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open