CVE-2002-2261

Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by...

7.5 HighFix available

CVE-2002-2261 is a high vulnerability (CVSS 7.5) in Sendmail, published December 31, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.00%, the 81st percentile. Fixed in sendmail 8.12.7.

What does this mean?

Severity: 7.5 HighCVSS 2.0, NVD
Exploit chance: 2.00%EPSS, 81st percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 8.12.7sendmail +2 more

Description

Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname.

Exploit likelihood

2.00%Unchanged since Feb 4, 2022

Affected products

sendmail

Affected packages

Affected packages
Package	Affected	Fixed
`sendmail` Debian:12	before 8.12.7	8.12.7
`sendmail` Debian:13	before 8.12.7	8.12.7
`sendmail` Debian:14	before 8.12.7	8.12.7

What each source reports

NVD Score used7.5

Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname.

Record: CVE-2002-2261
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE ListNo score

Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname.

Record: CVE-2002-2261
Updated: 2026-11-02

EUVDEUVD-2002-2240No score

Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname.

Record: EUVD-2002-2240
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vqjv-jhp4-724wNo score

Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by...

Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname.

Record: GHSA-vqjv-jhp4-724w
Updated: 2026-11-02

OSVNo score

Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname.

Record: CVE-2002-2261
Updated: 2026-11-02

OSVDEBIAN-CVE-2002-2261No score

Sendmail 8.9.0 through 8.12.6 allows remote attackers to bypass relaying restrictions enforced by the 'check_relay' function by spoofing a blank DNS hostname.

Record: DEBIAN-CVE-2002-2261
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 10, 2026	facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 5 moreShow less