3.7Low
CVE-2026-43964
Description
Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.
Weakness (CWE):
CWE-193
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Postfix | Postfix | 2.3 – < 3.8.16, 3.9 – < 3.9.10, 3.10 – < 3.10.9 | |
| Red Hat | Red Hat Enterprise Linux 10 | all versions | |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | all versions | |
| Red Hat | Red Hat Enterprise Linux 6 | — | |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | all versions | |
| Red Hat | Red Hat Enterprise Linux 8 | all versions | |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | all versions | |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | all versions | |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | all versions | |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | all versions | |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | all versions | |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | all versions | |
| Red Hat | Red Hat Enterprise Linux 9 | all versions |
References and patches
- https://www.mail-archive.com/postfix-announce@postfix.org/msg00110.html Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/05/04/30 Mailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2026:25930
- https://access.redhat.com/errata/RHSA-2026:25932
- https://access.redhat.com/errata/RHSA-2026:26205
- https://access.redhat.com/errata/RHSA-2026:50963
- https://access.redhat.com/errata/RHSA-2026:50964
- https://access.redhat.com/errata/RHSA-2026:51034
- https://access.redhat.com/errata/RHSA-2026:51436
- https://access.redhat.com/errata/RHSA-2026:57174
- https://access.redhat.com/security/cve/CVE-2026-43964
- https://bugzilla.redhat.com/show_bug.cgi?id=2466488
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43964.json
CPE matches (NVD) (3)
cpe:2.3:a:postfix:postfix:*:*:*:*:*:*:*:*< 3.8.16cpe:2.3:a:postfix:postfix:*:*:*:*:*:*:*:*≥ 3.9.0 < 3.9.10cpe:2.3:a:postfix:postfix:*:*:*:*:*:*:*:*≥ 3.10.0 < 3.10.9