CVE-2025-61962

Published: Oct 4, 2025Modified: Jun 17, 2026Deferred

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: MITRE (Secondary)

Description

In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.

Related CWEs

Improper Neutralization of Value Delimiters

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

References (4)

https://gitlab.com/fetchmail/fetchmail/-/commit/4c3cebfa4e659fb778ca2cae0ccb3f69201609a8

Source: cve@mitre.org

https://www.fetchmail.info/fetchmail-SA-2025-01.txt

Source: cve@mitre.org

https://www.openwall.com/lists/oss-security/2025/10/03/2

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2025/10/04/3

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.