Most recent entries from all

EUVD-2026-308456

fkie_cve-2026-43859

mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.

GHSA-rhvq-8hmp-hm8h

mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.

OESA-2026-2200 — mutt security update

Affected: openEuler:22.03-LTS-SP4: mutt, openEuler:24.03-LTS: mutt, openEuler:24.03-LTS-SP1: mutt, openEuler:24.03-LTS-SP3: mutt, openEuler:20.03-LTS-SP4: mutt

Mutt is a small but very powerful text-based mail client for Unix operating systems. Security Fix(es):

mutt before version 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest, which may lead to buffer handling issues.(CVE-2026-43859)

Mutt email client before version 2.3.2 contains a vulnerability where the hash_passwd is sometimes truncated by one byte during IMAP auth_cram MD5 digest authentication, potentially causing authentication failures or security issues.(CVE-2026-43860)

mutt before 2.3.2 does not check for '\0' in url_pct_decode, resulting in improper null byte handling vulnerability.(CVE-2026-43861)

In mutt before version 2.3.2, the imap_auth_gss security level is mishandled, which may lead to security vulnerabilities.(CVE-2026-43862)

mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.(CVE-2026-43863)

mutt before version 2.3.2 has a NULL pointer dereference vulnerability in the show_sig_summary function.(CVE-2026-43864)

openSUSE-SU-2026:10695-1 — mutt-2.3.2-1.1 on GA media

mutt-2.3.2-1.1 on GA media

SUSE-SU-2026:22340-1 — Security update for mutt

Security update for mutt

UBUNTU-CVE-2026-43859

Affected: Ubuntu:Pro:16.04:LTS: mutt, Ubuntu:Pro:18.04:LTS: mutt, Ubuntu:20.04:LTS: mutt, Ubuntu:22.04:LTS: mutt, Ubuntu:24.04:LTS: mutt, Ubuntu:25.10: mutt, Ubuntu:26.04:LTS: mutt

mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.

WID-SEC-W-2026-1343 — mutt: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in mutt ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um einen Denial-of-Service-Zustand herbeizuführen.