Read the docs
TI-2026-32009 Aliases CVE-2026-43964GHSA-c4gx-p7gq-g6hp

Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a…

Priority LOW 33CWE-193Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 12 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-193 and the CVSS impact.

Summary

Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00511 43rd percentileScored 2026-11-07
Fix Partial Postfix (Postfix): 3.8.16, 3.9.10, 3.10.9Red Hat: 8 advisoriesRed Hat: 12 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PostfixPostfix2.3 to before 3.8.16; 3.9 to before 3.9.10; 3.10 to before 3.10.93.8.16, 3.9.10, 3.10.9Patch availableCNA
  • Postfix VendorPostfix Affected 2.3 to before 3.8.16; 3.9 to before 3.9.10; 3.10 to before 3.10.9 Fixed in 3.8.16, 3.9.10, 3.10.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:postfix:postfix:*:*:*:*:*:*:*:*before 3.8.16; 3.9.0 to before 3.9.10; 3.10.0 to before 3.10.9VulnerablePostfix
  • cpe:2.3:a:postfix:postfix:*:*:*:*:*:*:*:* Versions before 3.8.16; 3.9.0 to before 3.9.10; 3.10.0 to before 3.10.9 Vulnerable ·Postfix

Remediation

  • Fix · CNA Postfix (Postfix) Fixed in 3.8.16, 3.9.10, 3.10.9

Red Hat 8 advisories

  • RHSA-2026:57174 Released 2026-08-19 · Red Hat rating Important
    postfix security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) postfix-2:2.10.1-9.el7_9.1
  • RHSA-2026:51436 Released 2026-08-06 · Red Hat rating Important
    postfix security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) postfix-2:3.8.5-8.el10_0.1
  • RHSA-2026:51034 Released 2026-08-06 · Red Hat rating Important
    postfix security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) postfix-2:3.5.8-1.el8_4.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) postfix-2:3.5.8-1.el8_4.1
Show 5 more Red Hat advisories
  • RHSA-2026:50964 Released 2026-08-06 · Red Hat rating Important
    postfix security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) postfix-2:3.5.8-4.el8_8.1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) postfix-2:3.5.8-4.el8_8.1
  • RHSA-2026:50963 Released 2026-08-06 · Red Hat rating Important
    postfix security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) postfix-2:3.5.8-4.el8_6.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) postfix-2:3.5.8-4.el8_6.1
  • RHSA-2026:26205 Released 2026-06-16 · Red Hat rating Important
    postfix security update
    • Red Hat Enterprise Linux AppStream (v. 9) postfix-2:3.5.25-3.el9_8, postfix-cdb-2:3.5.25-3.el9_8, postfix-ldap-2:3.5.25-3.el9_8 +6
  • RHSA-2026:25932 Released 2026-06-15 · Red Hat rating Important
    postfix security update
    • Red Hat Enterprise Linux AppStream (v. 8) postfix-cdb-2:3.5.8-8.el8_10, postfix-ldap-2:3.5.8-8.el8_10, postfix-mysql-2:3.5.8-8.el8_10 +4
    • Red Hat Enterprise Linux BaseOS (v. 8) postfix-2:3.5.8-8.el8_10
  • RHSA-2026:25930 Released 2026-06-15 · Red Hat rating Important
    postfix security update
    • Red Hat Enterprise Linux AppStream (v. 10) postfix-2:3.8.5-10.el10_2, postfix-cdb-2:3.8.5-10.el10_2, postfix-ldap-2:3.8.5-10.el10_2 +6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:25930
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:25932
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:26205
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:51436
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:25932
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:51034
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:50963
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:50964
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:51034
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)Fixed RHSA-2026:50963
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:50964
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:57174
Not affected: 15 products
  • Red Hat Enterprise Linux AppStream AUS (v.8.4)
  • Red Hat Enterprise Linux AppStream AUS (v.8.6)
  • Red Hat Enterprise Linux AppStream E4S (v.8.8)
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)
  • Red Hat Enterprise Linux AppStream TUS (v.8.8)
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • Red Hat Enterprise Linux Server (v. 7 ELS)
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43964
  2. 2026-10-03 Alias added: GHSA-c4gx-p7gq-g6hp
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 2

  • TI-2011-01499 The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and… CVSS 2.0MEDIUM 6.8
  • TI-2011-00345 The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x… CVSS 2.0MEDIUM 6.8
  • TI-2023-28393 Postfix through 3.8.5 allows SMTP smuggling unless configured with… CVSS 3.1MEDIUM 5.3
  • TI-2017-07491 Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2… CVSS 3.0HIGH 7.8
  • TI-2012-00748 Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5… CVSS 2.0MEDIUM 6.5
  • TI-2009-02800 The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package… CVSS 2.0MEDIUM 6.9
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences