Every CVE Search/ Get API key

CVE-2026-43863

mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.

3.7 LowFix available

mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.20%Up 0.2 points since May 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.7

mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.

Record
CVE-2026-43863
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-253
Updated
2026-11-02
EUVDEUVD-2026-26902 3.7

mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.

Record
EUVD-2026-26902
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-g7m5-w98f-vqg2 3.7

mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.

mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.

Record
GHSA-g7m5-w98f-vqg2
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-253
Updated
2026-11-02
NVD 3.7

mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.

Record
CVE-2026-43863
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-253
Updated
2026-11-02
OSV 3.7

mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.

Record
CVE-2026-43863
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-253
Updated
2026-11-02
OSVDEBIAN-CVE-2026-43863 3.7

mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.

Record
DEBIAN-CVE-2026-43863
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 10 moreShow less
OSVOESA-2026-2200 3.7

mutt security update

Mutt is a small but very powerful text-based mail client for Unix operating systems.

Security Fix(es):

mutt before version 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest, which may lead to buffer handling issues.(CVE-2026-43859)

Mutt email client before version 2.3.2 contains a vulnerability where the hash_passwd is sometimes truncated by one byte during IMAP auth_cram MD5 digest authentication, potentially causing authentication failures or security issues.(CVE-2026-43860)

mutt before 2.3.2 does not check for '\0' in url_pct_decode, resulting in improper null byte handling vulnerability.(CVE-2026-43861)

In mutt before version 2.3.2, the imap_auth_gss security level is mishandled, which may lead to security vulnerabilities.(CVE-2026-43862)

mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.(CVE-2026-43863)

mutt before version 2.3.2 has a NULL pointer dereference vulnerability in the show_sig_summary function.(CVE-2026-43864)

Record
OESA-2026-2200
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-43863 3.7

mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.

Record
UBUNTU-CVE-2026-43863
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-85590 No score

CVE-2026-43863 affecting package mutt 2.2.12-1

mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.

Record
AZL-85590
Updated
2026-11-05
OSVCLSA-2026-1790003865 No score

mutt: Fix of 6 CVEs

  • CVE-2026-43859: use memcpy() instead of strfcpy() in hmac_md5() so a binary MD5 digest of an over-long IMAP CRAM-MD5 secret is not truncated at an embedded NUL
  • CVE-2026-43860: copy the full MD5_DIGEST_LEN bytes of the hashed IMAP CRAM-MD5 secret in hmac_md5() instead of one byte less
  • CVE-2026-43861: reject a percent-encoded NUL (%00) as an invalid character in url_pct_decode()
  • CVE-2026-43862: check that the GSSAPI security-level token is at least 4 bytes before reading it in imap_auth_gss(), and read it as uint32_t
  • CVE-2026-43863: treat a negative gpgme_data_read() return as an error in data_object_to_stream() instead of looping forever
  • CVE-2026-43864: check key and key->subkeys for NULL in show_sig_summary()
Record
CLSA-2026-1790003865
Updated
2026-11-02
OSVCLSA-2026-1791192215 No score

mutt: Fix of 5 CVEs

  • CVE-2026-43859: use memcpy() for the IMAP CRAM-MD5 secret digest
  • CVE-2026-43860: fix one-byte truncation of the IMAP CRAM-MD5 digest
  • CVE-2026-43862: check GSSAPI security level size in imap_auth_gss()
  • CVE-2026-43863: fix infinite loop in gpgme data_object_to_stream()
  • CVE-2026-43864: fix NULL dereference in show_sig_summary()
Record
CLSA-2026-1791192215
Updated
2026-11-02
OSVopenSUSE-SU-2026:10695-1 No score

mutt-2.3.2-1.1 on GA media

These are all security issues fixed in the mutt-2.3.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10695-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21016-1 No score

Security update for mutt

This update for mutt fixes the following issues

  • CVE-2026-43859: strfcpy used instead of memcpy for the IMAP auth_cram MD5 digest (bsc#1263897).
  • CVE-2026-43860: truncation of hash_passwd by one byte for IMAP auth_cram MD5 digest (bsc#1263896).
  • CVE-2026-43861: missing check for \0 in url_pct_decode (bsc#1263895).
  • CVE-2026-43862: mishandling of the imap_auth_gss security level (bsc#1263894).
  • CVE-2026-43863: infinite loop in data_object_to_stream in crypt-gpgme.c (bsc#1263893).
  • CVE-2026-43864: NULL pointer dereference in function show_sig_summary (bsc#1263892).
Record
openSUSE-SU-2026:21016-1
Updated
2026-11-02
OSVSUSE-SU-2026:22340-1 No score

Security update for mutt

This update for mutt fixes the following issues

  • CVE-2026-43859: strfcpy used instead of memcpy for the IMAP auth_cram MD5 digest (bsc#1263897).
  • CVE-2026-43860: truncation of hash_passwd by one byte for IMAP auth_cram MD5 digest (bsc#1263896).
  • CVE-2026-43861: missing check for \0 in url_pct_decode (bsc#1263895).
  • CVE-2026-43862: mishandling of the imap_auth_gss security level (bsc#1263894).
  • CVE-2026-43863: infinite loop in data_object_to_stream in crypt-gpgme.c (bsc#1263893).
  • CVE-2026-43864: NULL pointer dereference in function show_sig_summary (bsc#1263892).
Record
SUSE-SU-2026:22340-1
Updated
2026-11-02
OSVSUSE-SU-2026:2300-1 No score

Security update for mutt

This update for mutt fixes the following issues

  • CVE-2026-43859: strfcpy used instead of memcpy for the IMAP auth_cram MD5 digest (bsc#1263897).
  • CVE-2026-43860: truncation of hash_passwd by one byte for IMAP auth_cram MD5 digest (bsc#1263896).
  • CVE-2026-43861: missing check for \0 in url_pct_decode (bsc#1263895).
  • CVE-2026-43862: mishandling of the imap_auth_gss security level (bsc#1263894).
  • CVE-2026-43863: infinite loop in data_object_to_stream in crypt-gpgme.c (bsc#1263893).
  • CVE-2026-43864: NULL pointer dereference in function show_sig_summary (bsc#1263892).
Record
SUSE-SU-2026:2300-1
Updated
2026-11-02
OSVSUSE-SU-2026:2301-1 No score

Security update for mutt

This update for mutt fixes the following issues

  • CVE-2026-43859: strfcpy used instead of memcpy for the IMAP auth_cram MD5 digest (bsc#1263897).
  • CVE-2026-43860: truncation of hash_passwd by one byte for IMAP auth_cram MD5 digest (bsc#1263896).
  • CVE-2026-43861: missing check for \0 in url_pct_decode (bsc#1263895).
  • CVE-2026-43862: mishandling of the imap_auth_gss security level (bsc#1263894).
  • CVE-2026-43863: infinite loop in data_object_to_stream in crypt-gpgme.c (bsc#1263893).
  • CVE-2026-43864: NULL pointer dereference in function show_sig_summary (bsc#1263892).
Record
SUSE-SU-2026:2301-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mutt
Azure Linux:3
 through 2.2.12-1 None known
mutt
TuxCare:AlmaLinux:9.6
From an advisory covering 6 CVEs
 before 5:2.2.6-2.el9_6.tuxcare.els3
5:2.2.6-2.el9_6.tuxcare.els3
mutt
TuxCare:AlmaLinux:9.2
From an advisory covering 5 CVEs
 before 5:2.2.6-1.el9_2.tuxcare.els4
5:2.2.6-1.el9_2.tuxcare.els4
mutt
Debian:12
 All versions, plus listed versions
2.2.12-0.12.2.12-0.1~deb12u12.2.13-12.2.9-12.2.9-1+deb12u12.3.2-12.4.0-12.4.1-1
 None known
mutt
Debian:13
 before 2.2.13-1+deb13u1, plus listed versions
2.2.13-1
2.2.13-1+deb13u1
mutt
Debian:14
 before 2.3.2-1, plus listed versions
2.2.13-1
2.3.2-1
mutt
openEuler:22.03-LTS-SP4
From an advisory covering 6 CVEs
 before 2.2.12-4.oe2203sp4
2.2.12-4.oe2203sp4
mutt
openEuler:24.03-LTS
From an advisory covering 6 CVEs
 before 2.2.12-4.oe2403sp3
2.2.12-4.oe2403sp3
mutt
openEuler:24.03-LTS-SP1
From an advisory covering 6 CVEs
 before 2.2.12-4.oe2403sp1
2.2.12-4.oe2403sp1
mutt
openEuler:24.03-LTS-SP3
From an advisory covering 6 CVEs
 before 2.2.12-4.oe2403sp3
2.2.12-4.oe2403sp3
Show 13 moreShow less
Affected packages
PackageAffectedFixed
mutt
openEuler:20.03-LTS-SP4
From an advisory covering 6 CVEs
 before 2.2.12-4.oe2003sp4
2.2.12-4.oe2003sp4
mutt
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 2.2.16-160000.2.1
2.2.16-160000.2.1
mutt
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 2.2.16-160000.2.1
2.2.16-160000.2.1
mutt
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.5.23-3.1ubuntu11.5.23-3.1ubuntu21.5.24-11.5.24-1build11.5.24-1ubuntu0.1
Show 7 moreShow less
1.5.24-1ubuntu0.21.5.24-1ubuntu0.31.5.24-1ubuntu0.41.5.24-1ubuntu0.51.5.24-1ubuntu0.61.5.24-1ubuntu0.6+esm21.5.24-1ubuntu0.6+esm3
 None known
mutt
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.8.3+neomutt20170609-2build11.9.1-21.9.1-31.9.1-41.9.1-5
Show 11 moreShow less
1.9.2-11.9.3-11.9.4-21.9.4-31.9.4-3ubuntu0.11.9.4-3ubuntu0.21.9.4-3ubuntu0.31.9.4-3ubuntu0.41.9.4-3ubuntu0.51.9.4-3ubuntu0.61.9.4-3ubuntu0.6+esm1
 None known
mutt
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.10.1-2.11.12.2-11.12.2-21.13.0-11.13.2-1
Show 6 moreShow less
1.13.2-1ubuntu0.11.13.2-1ubuntu0.21.13.2-1ubuntu0.31.13.2-1ubuntu0.41.13.2-1ubuntu0.51.13.2-1ubuntu0.6
 None known
mutt
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.0.5-4.1build12.1.3-12.1.4-12.1.4-1build12.1.4-1ubuntu1.12.1.4-1ubuntu1.2
 None known
mutt
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.2.9-12.2.9-1ubuntu0.23.10.12.2.12-0.12.2.12-0.1build22.2.12-0.1build32.2.12-0.1build4
 None known
mutt
Ubuntu:25.10
 All versions, plus listed versions
2.2.13-1
 None known
mutt
Ubuntu:26.10
 All versions, plus listed versions
2.2.13-1build22.3.2-12.4.0-12.4.1-1
 None known
mutt
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.2.13-12.2.13-1build12.2.13-1build2
 None known
mutt
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 2.3.2-1.1
2.3.2-1.1
mutt
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 2.2.16-160000.2.1
2.2.16-160000.2.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-43863 is a low vulnerability (CVSS 3.7) in Mutt, published May 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in mutt 2.2.13-1+deb13u1.

References

Show 25 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open