https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:47:56.588653+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2024:9243 ALSA-2024:9243 — Moderate: postfix security update 2026-10-03T14:47:56.770603+00:00

Affected: AlmaLinux:9: postfix, AlmaLinux:9: postfix-cdb, AlmaLinux:9: postfix-ldap, AlmaLinux:9: postfix-lmdb, AlmaLinux:9: postfix-mysql, AlmaLinux:9: postfix-pcre, AlmaLinux:9: postfix-perl-scripts, AlmaLinux:9: postfix-pgsql, AlmaLinux:9: postfix-sqlite

The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS.

Security Fix(es):

* postfix: SMTP smuggling vulnerability (CVE-2023-51764)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

 https://cve.radiocsirt.org/vuln/bdu:2024-00106 bdu:2024-00106 2026-10-03T14:47:56.770676+00:00 bdu:2024-00106 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0058 certfr-2024-avi-0058 — Une vulnérabilité a été découverte dans Postfix. Elle permet à un attaquant de provoquer un contournement de la politiq… 2026-10-03T14:47:56.770694+00:00 certfr-2024-avi-0058 https://cve.radiocsirt.org/vuln/euvd-2026-260120 EUVD-2026-260120 2026-10-03T14:47:56.770710+00:00 EUVD-2026-260120 https://cve.radiocsirt.org/vuln/fkie_cve-2023-51764 fkie_cve-2023-51764 2026-10-03T14:47:56.770722+00:00

Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.

 https://cve.radiocsirt.org/vuln/ghsa-j5jm-hg4x-w8rx GHSA-j5jm-hg4x-w8rx 2026-10-03T14:47:56.770748+00:00

Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages that appear to originate from the Postfix server, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required: the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.

 https://cve.radiocsirt.org/vuln/gsd-2023-51764 gsd-2023-51764 2026-10-03T14:47:56.770767+00:00 gsd-2023-51764 https://cve.radiocsirt.org/vuln/msrc_cve-2023-51764 msrc_CVE-2023-51764 — Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and… 2026-10-03T14:47:56.770778+00:00 msrc_CVE-2023-51764 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13538-1 openSUSE-SU-2024:13538-1 — postfix-3.8.4-2.1 on GA media 2026-10-03T14:47:56.770797+00:00

postfix-3.8.4-2.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2023:4981-1 SUSE-SU-2023:4981-1 — Security update for postfix 2026-10-03T14:47:56.770812+00:00

Security update for postfix

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-51764 UBUNTU-CVE-2023-51764 2026-10-03T14:47:56.770826+00:00

Affected: Ubuntu:Pro:14.04:LTS: postfix, Ubuntu:Pro:16.04:LTS: postfix, Ubuntu:Pro:18.04:LTS: postfix, Ubuntu:20.04:LTS: postfix, Ubuntu:22.04:LTS: postfix

Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-3206 WID-SEC-W-2023-3206 — SMTP Implementierungen: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2026-10-03T14:47:56.770855+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiedenen SMTP Implementierungen ausnutzen, um Sicherheitsvorkehrungen zu umgehen.