{"id":"CVE-2025-61962","aliases":["ALPINE-CVE-2025-61962","AZL-68127","AZL-68183","DEBIAN-CVE-2025-61962","EUVD-2025-32411","GHSA-q9v7-qrhr-3q9v","MGASA-2025-0238","OESA-2025-2423","OESA-2025-2424","OESA-2025-2425","OESA-2025-2426","OESA-2025-2427","OESA-2025-2428","SUSE-SU-2025:3845-1","SUSE-SU-2025:3966-1","SUSE-SU-2026:20935-1","UBUNTU-CVE-2025-61962","USN-7838-1","USN-9013-1","openSUSE-SU-2025:15653-1","openSUSE-SU-2026:20432-1"],"status":"published","title":"In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334...","description":"In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00409,"percentile":0.35632,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-142"],"published":"2025-10-04T00:00:00Z","modified":"2026-11-11T09:39:13Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"fetchmail","fixed_in":["6.5.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"fetchmail","fixed_in":["6.5.6-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fetchmail","fixed_in":["6.5.6-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"fetchmail","fixed_in":["6.5.6-1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"fetchmail","fixed_in":["6.4.22-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"fetchmail","fixed_in":["6.4.22-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"fetchmail","fixed_in":["6.4.22-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"fetchmail","fixed_in":["6.4.37-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"fetchmail","fixed_in":["6.4.37-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"fetchmail","fixed_in":["6.4.37-2.oe2403sp2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"fetchmail","fixed_in":["6.4.22-150600.35.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"fetchmail","fixed_in":["6.4.22-150600.35.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"fetchmail","fixed_in":["6.4.22-150600.35.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"fetchmail","fixed_in":["6.4.22-150600.35.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"fetchmail","fixed_in":["6.4.22-150600.35.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"fetchmail","fixed_in":["6.3.26-13.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"fetchmail","fixed_in":["6.5.2-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"fetchmail","fixed_in":["6.5.2-160000.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fetchmail","fixed_in":["6.3.26-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"fetchmail","fixed_in":["6.3.26-3ubuntu0.1~18.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"fetchmail","fixed_in":["6.4.2-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"fetchmail","fixed_in":["6.4.27-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"fetchmail","fixed_in":["6.4.38-1ubuntu4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"fetchmail","fixed_in":["6.5.4-0ubuntu2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"fetchmail","fixed_in":["6.5.4-0ubuntu2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"fetchmail","fixed_in":["6.5.6-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"fetchmail","fixed_in":["6.5.2-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4.39-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4.22-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.37-1","6.4.38-1","6.4.39-1","6.5.6-1","6.5.6-2","6.5.7-1","6.6.0-1","6.6.1-1","6.6.2-1","6.6.2-2","6.6.2-3","6.6.3-1","6.6.3-2","6.6.3-3","6.6.6-1","6.6.8-1","6.6.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.39-1","6.5.6-1","6.5.6-2","6.5.7-1","6.6.0-1","6.6.1-1","6.6.2-1","6.6.2-2","6.6.2-3","6.6.3-1","6.6.3-2","6.6.3-3","6.6.6-1","6.6.8-1","6.6.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.6-1"}]}],"versions":["6.4.39-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.6-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.37-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.37-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.37-2.oe2403sp2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-150600.35.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-150600.35.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-150600.35.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-150600.35.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.22-150600.35.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-13.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-160000.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-2ubuntu0.1~esm1"}]}],"versions":["6.3.26-1","6.3.26-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-3ubuntu0.1~18.04.1+esm1"}]}],"versions":["6.3.26-3","6.3.26-3build1","6.3.26-3ubuntu0.1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-2ubuntu0.1~esm1"}]}],"versions":["6.4.0~rc4-1ubuntu1","6.4.1-1ubuntu1","6.4.2-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.27-1ubuntu0.1"}]}],"versions":["6.4.22-1","6.4.23-1","6.4.24-1","6.4.25-1","6.4.26-1","6.4.27-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.38-1ubuntu4.1"}]}],"versions":["6.4.37-1","6.4.38-1ubuntu1","6.4.38-1ubuntu3","6.4.38-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.4-0ubuntu2"}]}],"versions":["6.4.39-1","6.5.4-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.4-0ubuntu2"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.27-1ubuntu0.1"}]}],"versions":["6.4.22-1","6.4.23-1","6.4.24-1","6.4.25-1","6.4.26-1","6.4.27-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.38-1ubuntu4.1"}]}],"versions":["6.4.37-1","6.4.38-1ubuntu1","6.4.38-1ubuntu3","6.4.38-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-2ubuntu0.1~esm1"}]}],"versions":["6.3.26-1","6.3.26-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.26-3ubuntu0.1~18.04.1+esm1"}]}],"versions":["6.3.26-3","6.3.26-3build1","6.3.26-3ubuntu0.1~18.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.2-2ubuntu0.1~esm1"}]}],"versions":["6.4.0~rc4-1ubuntu1","6.4.1-1ubuntu1","6.4.2-2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.27-1ubuntu0.2"}]}],"versions":["6.4.22-1","6.4.23-1","6.4.24-1","6.4.25-1","6.4.26-1","6.4.27-1","6.4.27-1ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.38-1ubuntu4.2"}]}],"versions":["6.4.37-1","6.4.38-1ubuntu1","6.4.38-1ubuntu3","6.4.38-1ubuntu4","6.4.38-1ubuntu4.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.6-1ubuntu0.1"}]}],"versions":["6.6.2-2","6.6.3-3","6.6.6-1","6.6.6-1build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-2ubuntu0.1"}]}],"versions":["6.5.4-0ubuntu2","6.5.4-0ubuntu3","6.6.2-2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.6-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"fetchmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-160000.3.1"}]}]}],"products":[{"vendor":"fetchmail","product":"fetchmail"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2025/10/03/2","tags":["web","report"]},{"url":"https://www.fetchmail.info/fetchmail-SA-2025-01.txt","tags":["web","report"]},{"url":"https://gitlab.com/fetchmail/fetchmail/-/commit/4c3cebfa4e659fb778ca2cae0ccb3f69201609a8","tags":["fix"]},{"url":"http://www.openwall.com/lists/oss-security/2025/10/04/3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61962","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-q9v7-qrhr-3q9v"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-61962","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61962.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-61962","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0238.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34644","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/10/04/3","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2423","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2424","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2425","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2426","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2427","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2428","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253845-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1251194","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61962","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253966-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620935-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-61962","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61962","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7838-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-9013-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-36386","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-94184","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-61962","description":"In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.","status":"published","published":"2025-10-04T00:00:00Z","modified":"2025-11-04T21:14:11.806Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-142"],"updated_at":"2026-11-02T14:32:45.105469Z"}],"euvd":[{"id":"EUVD-2025-32411","description":"In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.","status":"published","published":"2025-10-04T00:00:00Z","modified":"2025-11-04T21:14:11Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:20.707326Z"}],"ghsa":[{"id":"GHSA-q9v7-qrhr-3q9v","title":"In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334...","description":"In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.","status":"published","published":"2025-10-04T03:32:59Z","modified":"2025-11-05T00:31:29Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-142"],"updated_at":"2026-11-02T15:04:39.50413Z"}],"nvd":[{"id":"CVE-2025-61962","description":"In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.","status":"published","published":"2025-10-04T03:15:37.87Z","modified":"2026-10-19T16:10:00.26Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-142"],"updated_at":"2026-11-02T14:11:34.090044Z"}],"osv":[{"id":"ALPINE-CVE-2025-61962","description":"In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.","status":"published","published":"2025-10-04T03:15:37.87Z","modified":"2026-11-03T06:33:01.005206347Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2025-61962","description":"In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.","status":"published","published":"2025-10-04T00:00:00Z","modified":"2026-10-28T10:45:51.024798459Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-142"],"updated_at":"2026-11-02T15:44:51.516975Z"},{"id":"DEBIAN-CVE-2025-61962","description":"In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.","status":"published","published":"2025-10-04T03:15:37.87Z","modified":"2026-10-23T18:04:36.970288383Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"OESA-2025-2423","title":"fetchmail security update","description":"Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client.\r\n\r\nSecurity Fix(es):\n\nIn fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. This vulnerability is classified as CWE-142. The product receives input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component, which impacts availability.(CVE-2025-61962)","status":"published","published":"2025-10-17T11:09:30Z","modified":"2026-08-18T01:19:13.811019794Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2424","title":"fetchmail security update","description":"Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client.\r\n\r\nSecurity Fix(es):\n\nIn fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. This vulnerability is classified as CWE-142. The product receives input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component, which impacts availability.(CVE-2025-61962)","status":"published","published":"2025-10-17T11:09:30Z","modified":"2026-08-18T01:19:13.806918434Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2425","title":"fetchmail security update","description":"Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client.\r\n\r\nSecurity Fix(es):\n\nIn fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. This vulnerability is classified as CWE-142. The product receives input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component, which impacts availability.(CVE-2025-61962)","status":"published","published":"2025-10-17T11:09:31Z","modified":"2026-08-18T01:19:13.75138859Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2426","title":"fetchmail security update","description":"Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client.\r\n\r\nSecurity Fix(es):\n\nIn fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. This vulnerability is classified as CWE-142. The product receives input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component, which impacts availability.(CVE-2025-61962)","status":"published","published":"2025-10-17T11:09:31Z","modified":"2026-08-18T01:19:13.805420218Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2427","title":"fetchmail security update","description":"Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client.\r\n\r\nSecurity Fix(es):\n\nIn fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. This vulnerability is classified as CWE-142. The product receives input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component, which impacts availability.(CVE-2025-61962)","status":"published","published":"2025-10-17T11:09:31Z","modified":"2026-08-18T01:19:13.841630586Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2428","title":"fetchmail security update","description":"Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client.\r\n\r\nSecurity Fix(es):\n\nIn fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context. This vulnerability is classified as CWE-142. The product receives input from an upstream component but does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component, which impacts availability.(CVE-2025-61962)","status":"published","published":"2025-10-17T11:09:31Z","modified":"2026-08-18T01:19:13.842112813Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"UBUNTU-CVE-2025-61962","description":"In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.","status":"published","published":"2025-10-04T03:15:00Z","modified":"2026-11-11T09:44:30.360190214Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-11T10:01:08.15793Z"},{"id":"AZL-68127","title":"CVE-2025-61962 affecting package fetchmail 6.4.39-2","description":"In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.","status":"published","published":"2025-10-04T03:15:37Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:23.994498Z"},{"id":"AZL-68183","title":"CVE-2025-61962 affecting package fetchmail 6.4.22-1","description":"In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.","status":"published","published":"2025-10-04T03:15:37Z","modified":"2026-04-21T04:38:20.681187Z","updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"MGASA-2025-0238","title":"Updated fetchmail package fixes security vulnerability","description":"It was discovered that fetchmail's SMTP client, when configured to\nauthenticate, is susceptible to a protocol violation where, when a\ntrusted but malicious or malfunctioning SMTP server responds to an\nauthentication request with a \"334\" code but without a following blank\non the line, it will attempt to start reading from memory address 0x1 to\nparse the server's SASL challenge. This event will usually cause a crash\nof fetchmail (CVE-2025-61962).\n","status":"published","published":"2025-10-14T17:45:08Z","modified":"2026-04-16T04:42:53.80234328Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15653-1","title":"fetchmail-6.5.6-1.1 on GA media","description":"These are all security issues fixed in the fetchmail-6.5.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-21T00:00:00Z","modified":"2026-03-23T04:54:03.52409Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:20432-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2025-61962: Fixed denial of service (bsc#1251194)\n","status":"published","published":"2026-03-26T09:57:56Z","modified":"2026-04-03T17:25:50.037696Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2025:3845-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n  - CVE-2025-61962: fixed a denial of service condition (bsc#1251194)\n","status":"published","published":"2025-10-28T16:42:49Z","modified":"2026-03-23T04:50:21.355854Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3966-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n  - CVE-2025-61962: fixed a denial of service condition (bsc#1251194)\n","status":"published","published":"2025-11-06T10:48:18Z","modified":"2026-03-23T04:51:22.33467Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2026:20935-1","title":"Security update for fetchmail","description":"This update for fetchmail fixes the following issues:\n\n- CVE-2025-61962: Fixed denial of service (bsc#1251194)\n","status":"published","published":"2026-03-26T09:57:50Z","modified":"2026-04-02T17:24:55.288198Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"USN-7838-1","title":"fetchmail vulnerability","description":"It was discovered that the fetchmail SMTP client incorrectly handled\ncertain status code messages. An attacker controlling a malicious server\ncould possibly use this issue to cause fetchmail to crash, resulting in a\ndenial of service.","status":"published","published":"2025-10-23T16:39:33Z","modified":"2026-04-27T18:24:18.767129Z","updated_at":"2026-11-02T16:58:21.91885Z"},{"id":"USN-9013-1","title":"fetchmail vulnerabilities","description":"Christian Herdtweck discovered that Fetchmail incorrectly handled certain\nlong log messages. A remote attacker could possibly use this issue to cause\nFetchmail to crash, resulting in a denial of service. This issue only\naffected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n(CVE-2021-36386)\n\nIt was discovered that the Fetchmail SMTP client incorrectly handled\ncertain status code messages. An attacker controlling a malicious server\ncould possibly use this issue to cause Fetchmail to crash, resulting in a\ndenial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04\nLTS, and Ubuntu 20.04 LTS. (CVE-2025-61962)\n\nTristan Madani discovered that Fetchmail incorrectly handled certain NTLM\nauthentication challenges. A remote attacker could possibly use this issue\nto cause Fetchmail to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. The default compiler options for affected releases\nshould reduce the vulnerability to a denial of service. (CVE-2026-94184)","status":"published","published":"2026-11-09T17:17:55Z","modified":"2026-11-11T09:43:32.235894003Z","updated_at":"2026-11-10T03:21:46.325253Z"}]}}