Every CVE Search/ Get API key

CVE-2009-4565

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of...

7.5 HighFix available

CVE-2009-4565 is a high vulnerability (CVSS 7.5) in Sendmail, published January 4, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.40%, the 84th percentile. Fixed in sendmail 8.14.3-9.1.

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Exploit likelihood

2.40%Down 2.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
CVE-2009-4565
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-310
Updated
2026-11-02
CVE List No score

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
CVE-2009-4565
Updated
2026-11-02
EUVDEUVD-2009-4531 No score

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
EUVD-2009-4531
Updated
2026-11-03
GitHub AdvisoriesGHSA-g4p5-56vp-vcg5 No score

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of...

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
GHSA-g4p5-56vp-vcg5
Updated
2026-11-02
OSV No score

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
CVE-2009-4565
Updated
2026-11-02
OSVDEBIAN-CVE-2009-4565 No score

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
DEBIAN-CVE-2009-4565
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sendmail
Debian:12
 before 8.14.3-9.1
8.14.3-9.1
sendmail
Debian:13
 before 8.14.3-9.1
8.14.3-9.1
sendmail
Debian:14
 before 8.14.3-9.1
8.14.3-9.1
sendmail
Debian:4.0
 before 8.13.8-3+etch1, plus listed versions
8.13.8-3
8.13.8-3+etch1
sendmail
Debian:5.0
 before 8.14.3-5+lenny1, plus listed versions
8.14.3-5
8.14.3-5+lenny1
sendmail
Red Hat:enterprise_linux:5::client_workstation
 before 0:8.13.8-8.el5
0:8.13.8-8.el5
sendmail-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:8.13.8-8.el5
0:8.13.8-8.el5
sendmail-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:8.13.8-8.el5
0:8.13.8-8.el5
sendmail
Red Hat:enterprise_linux:5::client
 before 0:8.13.8-8.el5
0:8.13.8-8.el5
sendmail-cf
Red Hat:enterprise_linux:5::client
 before 0:8.13.8-8.el5
0:8.13.8-8.el5
Show 27 moreShow less
Affected packages
PackageAffectedFixed
sendmail-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:8.13.8-8.el5
0:8.13.8-8.el5
sendmail-doc
Red Hat:enterprise_linux:5::client
 before 0:8.13.8-8.el5
0:8.13.8-8.el5
sendmail
Red Hat:enterprise_linux:5::server
 before 0:8.13.8-8.el5
0:8.13.8-8.el5
sendmail-cf
Red Hat:enterprise_linux:5::server
 before 0:8.13.8-8.el5
0:8.13.8-8.el5
sendmail-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:8.13.8-8.el5
0:8.13.8-8.el5
sendmail-devel
Red Hat:enterprise_linux:5::server
 before 0:8.13.8-8.el5
0:8.13.8-8.el5
sendmail-doc
Red Hat:enterprise_linux:5::server
 before 0:8.13.8-8.el5
0:8.13.8-8.el5
sendmail
Red Hat:enterprise_linux:4::as
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-cf
Red Hat:enterprise_linux:4::as
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-devel
Red Hat:enterprise_linux:4::as
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-doc
Red Hat:enterprise_linux:4::as
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail
Red Hat:enterprise_linux:4::desktop
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-cf
Red Hat:enterprise_linux:4::desktop
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-devel
Red Hat:enterprise_linux:4::desktop
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-doc
Red Hat:enterprise_linux:4::desktop
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail
Red Hat:enterprise_linux:4::es
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-cf
Red Hat:enterprise_linux:4::es
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-devel
Red Hat:enterprise_linux:4::es
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-doc
Red Hat:enterprise_linux:4::es
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail
Red Hat:enterprise_linux:4::ws
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-cf
Red Hat:enterprise_linux:4::ws
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-devel
Red Hat:enterprise_linux:4::ws
 before 0:8.13.1-6.el4
0:8.13.1-6.el4
sendmail-doc
Red Hat:enterprise_linux:4::ws
 before 0:8.13.1-6.el4
0:8.13.1-6.el4

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 36 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open