CVE-2022-24732: Use of a Key Past its Expiration Date and Insufficient Session Expiration in Maddy Mail Server
Summary
CVE-2022-24732: Use of a Key Past its Expiration Date and Insufficient Session Expiration in Maddy Mail Server. Affects github.com/foxcpp/maddy versions < 0.5.4. Fixed in 0.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Maddy is an open-source mail server written in Go. It provides a simple and efficient solution for handling email communication. The server supports various authentication methods, including PAM (Pluggable Authentication Modules) and /etc/shadow authentication. Maddy versions prior to 0.5.4 are affected by a vulnerability related to the use of expired keys and insufficient session expiration when using PAM authentication.
Vulnerability Detail
The vulnerability in Maddy mail server allows authentication using PAM without checking for password or account expiration. This means that even if a user's password or account has expired, they can still authenticate successfully. This can lead to unauthorized access to the mail server and potential misuse of user accounts. The issue is present in all configurations using auth.pam on Maddy versions below 0.5.4.
How To Fix
Latest published version: v0.9.6 as of 23 Oct 2026
go get github.com/foxcpp/maddy@v0.9.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.4
This is the first release that contains the fix.
go get github.com/foxcpp/maddy@v0.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately update to Maddy 0.5.4, there are two possible workarounds:
-
If you are using /etc/shadow authentication instead of PAM, you can replace auth.pam with auth.shadow, which is not affected by this vulnerability.
-
You can blacklist expired accounts using existing filtering mechanisms, such as the auth_map to invalidate accounts in storage.imapsql.
Conclusion
The vulnerability in Maddy mail server allows users with expired passwords or accounts to authenticate successfully. To mitigate this issue, it is recommended to update Maddy to version 0.5.4 or later. Alternatively, you can use the provided workarounds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/foxcpp/maddy →
FAQ
All Maddy versions prior to 0.5.4 are affected.
The vulnerability allows users with expired passwords or accounts to authenticate successfully, potentially leading to unauthorized access and misuse of user accounts.
Updating Maddy to version 0.5.4 or later will fix this vulnerability. The patch is included in the 0.5.4 release.
Yes, if you are unable to update immediately, you can either switch to /etc/shadow authentication or blacklist expired accounts using existing filtering mechanisms.
You can find more information about this vulnerability in the GitHub advisory for GHSA-6cp7-g972-w9m9.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/foxcpp/maddy.
