{"id":"CVE-2024-49394","aliases":["CLSA-2026-1783434809","CLSA-2026-1783436433","DEBIAN-CVE-2024-49394","EUVD-2024-43421","GHSA-q998-8jff-x3rg","MGASA-2025-0070","UBUNTU-CVE-2024-49394","USN-7204-1","openSUSE-SU-2024:14527-1"],"status":"published","title":"Mutt: neomutt: in-reply-to email header field it not protected by cryptograpic signing","description":"In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00325,"percentile":0.25752,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2024-11-12T02:07:19Z","modified":"2026-11-02T12:03:04Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"mutt","fixed_in":["5:2.2.6-1.el9_2.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"mutt","fixed_in":["5:2.2.6-2.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"neomutt","fixed_in":["20241002+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"neomutt","fixed_in":["20241002+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"neomutt","fixed_in":["20191207+dfsg.1-1.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"neomutt","fixed_in":["20211029+dfsg1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"neomutt","fixed_in":["20231103+dfsg1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.2.6-1.el9_2.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.2.6-2.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.12-0.1","2.2.12-0.1~deb12u1","2.2.13-1","2.2.9-1","2.2.9-1+deb12u1","2.3.2-1","2.4.0-1","2.4.1-1","2.4.1-1.1"]},{"source":"osv","ecosystem":"Debian:13","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.13-1","2.2.13-1+deb13u1","2.2.13-1+deb13u2","2.3.2-1","2.4.0-1","2.4.1-1","2.4.1-1.1"]},{"source":"osv","ecosystem":"Debian:14","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.13-1","2.3.2-1","2.4.0-1","2.4.1-1","2.4.1-1.1"]},{"source":"osv","ecosystem":"Debian:12","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20220429+dfsg1-4.1","20231103+dfsg1-1","20240425+dfsg-1","20240425+dfsg-2","20241002+dfsg-1","20241002+dfsg-1~bpo12+1","20241114+dfsg-1","20241114+dfsg1-1","20241212+dfsg-1","20241212+dfsg-2","20250109+dfsg-1","20250113+dfsg-1","20250113+dfsg-1~bpo12+1","20250404+dfsg-1","20250404+dfsg-1~bpo12+1","20250404+dfsg-2","20250404+dfsg-2~bpo12+1","20250404+dfsg-2~bpo12+2","20250510+dfsg-1","20250510+dfsg-2","20250510+dfsg-2~bpo12+1","20250905+dfsg-1","20251211+dfsg-1","20260105+dfsg-1","20260105+dfsg-1~bpo13+1","20260406+dfsg-1","20260504+dfsg-1","20260616+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241002+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241002+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241002-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.23-3.1ubuntu1","1.5.23-3.1ubuntu2","1.5.24-1","1.5.24-1build1","1.5.24-1ubuntu0.1","1.5.24-1ubuntu0.2","1.5.24-1ubuntu0.3","1.5.24-1ubuntu0.4","1.5.24-1ubuntu0.5","1.5.24-1ubuntu0.6","1.5.24-1ubuntu0.6+esm2","1.5.24-1ubuntu0.6+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3+neomutt20170609-2build1","1.9.1-2","1.9.1-3","1.9.1-4","1.9.1-5","1.9.2-1","1.9.3-1","1.9.4-2","1.9.4-3","1.9.4-3ubuntu0.1","1.9.4-3ubuntu0.2","1.9.4-3ubuntu0.3","1.9.4-3ubuntu0.4","1.9.4-3ubuntu0.5","1.9.4-3ubuntu0.6","1.9.4-3ubuntu0.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20171027-1","20171027-2","20171027+dfsg.1-1","20171027+dfsg.1-2","20171027+dfsg.1-4","20171208+dfsg.1-1","20171208+dfsg.1-2","20171215+dfsg.1-1","20171215+dfsg.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1-2.1","1.12.2-1","1.12.2-2","1.13.0-1","1.13.2-1","1.13.2-1ubuntu0.1","1.13.2-1ubuntu0.2","1.13.2-1ubuntu0.3","1.13.2-1ubuntu0.4","1.13.2-1ubuntu0.5","1.13.2-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20191207+dfsg.1-1.1ubuntu0.1~esm1"}]}],"versions":["20180716+dfsg.1-1.2","20191111+dfsg.1-1","20191207+dfsg.1-1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.5-4.1build1","2.1.3-1","2.1.4-1","2.1.4-1build1","2.1.4-1ubuntu1.1","2.1.4-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20211029+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["20201127+dfsg.1-1.2","20211029+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.9-1","2.2.9-1ubuntu0.23.10.1","2.2.12-0.1","2.2.12-0.1build2","2.2.12-0.1build3","2.2.12-0.1build4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20231103+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["20220429+dfsg1-4.1","20231103+dfsg1-1","20231103+dfsg1-1build2","20231103+dfsg1-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.13-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.13-1build2","2.3.2-1","2.4.0-1","2.4.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.13-1","2.2.13-1build1","2.2.13-1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20171215+dfsg.1-1ubuntu0.1~esm1"}]}],"versions":["20171027-1","20171027-2","20171027+dfsg.1-1","20171027+dfsg.1-2","20171027+dfsg.1-4","20171208+dfsg.1-1","20171208+dfsg.1-2","20171215+dfsg.1-1"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20191207+dfsg.1-1.1ubuntu0.1~esm1"}]}],"versions":["20180716+dfsg.1-1.2","20191111+dfsg.1-1","20191207+dfsg.1-1.1"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20211029+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["20201127+dfsg.1-1.2","20211029+dfsg1-1"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20231103+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["20220429+dfsg1-4.1","20231103+dfsg1-1","20231103+dfsg1-1build2","20231103+dfsg1-1build3"],"bundled":21},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"neomutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241114-1.1"}]}],"bundled":2}],"products":[{"vendor":"mutt","product":"mutt"},{"vendor":"neomutt","product":"neomutt"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-49394","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2325330","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/neomutt/neomutt/issues/4226"},{"url":"https://github.com/neomutt/neomutt/pull/4221"},{"url":"https://github.com/neomutt/neomutt/pull/4227"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49394","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q998-8jff-x3rg"},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1783434809.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1783436433.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-49394","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0070.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33814","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ZYFPGXOX4Q4I4UNPEGXP2N372IN2YSAS/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-49394","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-49394","tags":["report"]},{"url":"https://gitlab.com/muttmua/mutt/-/issues/490#note_2209448655","tags":["report"]},{"url":"http://mutt.org/doc/manual/#crypt-protected-headers-read","tags":["report"]},{"url":"https://github.com/neomutt/neomutt/commit/13cfc6f98322eafdc30ecc4c15999d401950a1d9","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7204-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-14349","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14352","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14353","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14355","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14356","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14358","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14361","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14362","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28896","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32055","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-1328","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-49393","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZYFPGXOX4Q4I4UNPEGXP2N372IN2YSAS/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49394","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-49394","title":"Mutt: neomutt: in-reply-to email header field it not protected by cryptograpic signing","description":"In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.","status":"published","published":"2024-11-12T02:07:19.551Z","modified":"2026-11-06T14:29:32.423Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-06T15:28:32.799664Z"}],"euvd":[{"id":"EUVD-2024-43421","description":"In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.","status":"published","published":"2024-11-12T02:07:19Z","modified":"2026-11-06T14:29:32Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-06T15:05:10.688381Z"}],"ghsa":[{"id":"GHSA-q998-8jff-x3rg","title":"In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing...","description":"In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.","status":"published","published":"2024-11-12T03:30:48Z","modified":"2026-06-26T03:31:25Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:08:59.978633Z"}],"nvd":[{"id":"CVE-2024-49394","description":"In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.","status":"published","published":"2024-11-12T03:15:03.677Z","modified":"2026-11-06T15:17:02.833Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-06T18:00:49.930273Z"}],"osv":[{"id":"CVE-2024-49394","description":"In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.","status":"published","published":"2024-11-12T03:15:03.677Z","modified":"2026-04-16T04:39:07.045529841Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"DEBIAN-CVE-2024-49394","description":"In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.","status":"published","published":"2024-11-12T03:15:03.677Z","modified":"2026-11-07T09:47:30.111149264Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"UBUNTU-CVE-2024-49394","description":"In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.","status":"published","published":"2024-11-12T03:15:00Z","modified":"2026-10-17T12:56:45.532343108Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:06.818511Z"},{"id":"CLSA-2026-1783434809","title":"mutt: Fix of CVE-2024-49394","description":"- CVE-2024-49394: fix In-Reply-To and References headers not being copied into protected headers","status":"published","published":"2026-07-07T14:33:45Z","modified":"2026-10-26T09:30:24.239984845Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1783436433","title":"mutt: Fix of CVE-2024-49394","description":"- CVE-2024-49394: protect In-Reply-To and References under the cryptographic signature (add to protected headers)","status":"published","published":"2026-07-07T15:09:05Z","modified":"2026-10-26T09:31:13.482558248Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"MGASA-2025-0070","title":"Updated neomutt packages fix security vulnerabilities","description":"The To and Cc email header fields are not protected by cryptographic\nsigning. (CVE-2024-49393)\nThe In-reply-to email header field is not protected by cryptographic signing.\n(CVE-2024-49394)\n","status":"published","published":"2025-02-24T18:29:49Z","modified":"2026-04-16T04:41:41.311882866Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2024:14527-1","title":"neomutt-20241114-1.1 on GA media","description":"These are all security issues fixed in the neomutt-20241114-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-26T00:00:00Z","modified":"2026-02-04T03:22:41.210312Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"USN-7204-1","title":"neomutt vulnerabilities","description":"Jeriko One discovered that NeoMutt incorrectly handled certain IMAP\nand POP3 responses. An attacker could possibly use this issue to\ncause NeoMutt to crash, resulting in a denial of service, or\nthe execution of arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2018-14349, CVE-2018-14350, CVE-2018-14351,\nCVE-2018-14352, CVE-2018-14353, CVE-2018-14354, CVE-2018-14355,\nCVE-2018-14356, CVE-2018-14357, CVE-2018-14358, CVE-2018-14359,\nCVE-2018-14362)\n\nJeriko One discovered that NeoMutt incorrectly handled certain\nNNTP-related operations. An attacker could possibly use this issue\nto cause NeoMutt to crash, resulting in denial of service, or\nthe execution of arbitrary code. This issue only affected\nUbuntu 18.04 LTS. (CVE-2018-14360, CVE-2018-14361, CVE-2018-14363)\n\nIt was discovered that NeoMutt incorrectly processed additional data\nwhen communicating with mail servers. An attacker could possibly use\nthis issue to access senstive information. This issue only affected\nUbuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14954, CVE-2020-28896)\n\nIt was discovered that Neomutt incorrectly handled the IMAP QRSync\nsetting. An attacker could possibly use this issue to cause NeoMutt\nto crash, resulting in denial of service. This issue only affected\nUbuntu 20.04 LTS. (CVE-2021-32055)\n\nTavis Ormandy discovered that NeoMutt incorrectly parsed uuencoded\ntext past the length of the string. An attacker could possibly use\nthis issue to enable the execution of arbitrary code. This issue\nonly affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and\nUbuntu 22.04 LTS. (CVE-2022-1328)\n\nIt was discovered that NeoMutt did not properly encrypt email headers.\nAn attacker could possibly use this issue to receive emails that were\nnot intended for them and access sensitive information. This\nvulnerability was only fixed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nand Ubuntu 24.04 LTS. (CVE-2024-49393, CVE-2024-49394)\n","status":"published","published":"2025-01-15T16:07:30Z","modified":"2026-04-27T17:47:18.478449179Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}