Vulnerability · Published May 4, 2026 · Assigned by mitre
CVE-2026-43964
Low 3.7
In plain English
A low-severity security flaw in Postfix from Postfix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.5%top 56.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | postfix | 2:3.8.5-10.el10_2 | ALSA-2026:25930 |
| AlmaLinux:8 | postfix | 2:3.5.8-8.el8_10 | ALSA-2026:25932 |
| AlmaLinux:9 | postfix | 2:3.5.25-3.el9_8 | ALSA-2026:26205 |
| AlmaLinux:10 | postfix-cdb | 2:3.8.5-10.el10_2 | ALSA-2026:25930 |
| AlmaLinux:8 | postfix-cdb | 2:3.5.8-8.el8_10 | ALSA-2026:25932 |
| AlmaLinux:9 | postfix-cdb | 2:3.5.25-3.el9_8 | ALSA-2026:26205 |
| AlmaLinux:10 | postfix-ldap | 2:3.8.5-10.el10_2 | ALSA-2026:25930 |
| AlmaLinux:8 | postfix-ldap | 2:3.5.8-8.el8_10 | ALSA-2026:25932 |
| AlmaLinux:9 | postfix-ldap | 2:3.5.25-3.el9_8 | ALSA-2026:26205 |
| AlmaLinux:10 | postfix-lmdb | 2:3.8.5-10.el10_2 | ALSA-2026:25930 |
| AlmaLinux:9 | postfix-lmdb | 2:3.5.25-3.el9_8 | ALSA-2026:26205 |
| AlmaLinux:10 | postfix-mysql | 2:3.8.5-10.el10_2 | ALSA-2026:25930 |
| AlmaLinux:8 | postfix-mysql | 2:3.5.8-8.el8_10 | ALSA-2026:25932 |
| AlmaLinux:9 | postfix-mysql | 2:3.5.25-3.el9_8 | ALSA-2026:26205 |
| AlmaLinux:10 | postfix-pcre | 2:3.8.5-10.el10_2 | ALSA-2026:25930 |
| AlmaLinux:8 | postfix-pcre | 2:3.5.8-8.el8_10 | ALSA-2026:25932 |
| AlmaLinux:9 | postfix-pcre | 2:3.5.25-3.el9_8 | ALSA-2026:26205 |
| AlmaLinux:10 | postfix-perl-scripts | 2:3.8.5-10.el10_2 | ALSA-2026:25930 |
| AlmaLinux:8 | postfix-perl-scripts | 2:3.5.8-8.el8_10 | ALSA-2026:25932 |
| AlmaLinux:9 | postfix-perl-scripts | 2:3.5.25-3.el9_8 | ALSA-2026:26205 |
| AlmaLinux:10 | postfix-pgsql | 2:3.8.5-10.el10_2 | ALSA-2026:25930 |
| AlmaLinux:8 | postfix-pgsql | 2:3.5.8-8.el8_10 | ALSA-2026:25932 |
| AlmaLinux:9 | postfix-pgsql | 2:3.5.25-3.el9_8 | ALSA-2026:26205 |
| AlmaLinux:10 | postfix-sqlite | 2:3.8.5-10.el10_2 | ALSA-2026:25930 |
| AlmaLinux:8 | postfix-sqlite | 2:3.5.8-8.el8_10 | ALSA-2026:25932 |
| AlmaLinux:9 | postfix-sqlite | 2:3.5.25-3.el9_8 | ALSA-2026:26205 |
| Debian:12 | postfix | no fix listed | DEBIAN-CVE-2026-43964 |
| Debian:13 | postfix | 3.10.10-0+deb13u1 | DEBIAN-CVE-2026-43964 |
| Debian:14 | postfix | 3.11.2-1 | DEBIAN-CVE-2026-43964 |
| Rocky Linux:10 | postfix | 2:3.8.5-10.el10_2 | RLSA-2026:25930 |
| Rocky Linux:8 | postfix | 2:3.5.8-8.el8_10 | RLSA-2026:25932 |
| Rocky Linux:9 | postfix | 2:3.5.25-3.el9_8 | RLSA-2026:26205 |
| Ubuntu:22.04:LTS | postfix | 3.6.4-1ubuntu1.4 | UBUNTU-CVE-2026-43964 |
| Ubuntu:24.04:LTS | postfix | 3.8.6-1ubuntu0.1 | UBUNTU-CVE-2026-43964 |
| Ubuntu:25.10 | postfix | 3.10.2-1ubuntu2.1 | UBUNTU-CVE-2026-43964 |
| Ubuntu:26.04:LTS | postfix | 3.10.6-4ubuntu2.1 | UBUNTU-CVE-2026-43964 |
Affected products (as reported)
Weakness: CWE-193 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://www.mail-archive.com/postfix-announce@postfix.org/msg00110.html
- http://www.openwall.com/lists/oss-security/2026/05/04/30
- https://access.redhat.com/security/cve/CVE-2026-43964 vdb-entry, x_refsource_REDHAT
- RHBZ#2466488 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43964.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:57174 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51436 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25930 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25932 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26205 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51034 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50963 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50964 vendor-advisory, x_refsource_REDHAT