Moderate Vulnerability in Fetchmail: Stack-Based Buffer Overflow in NTLM Authentication
Summary
RLSA-2026:86981: Moderate: fetchmail security update. Affects fetchmail versions < 0:6.4.24-1.el9_8.1. Fixed in 0:6.4.24-1.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fetchmail is a remote mail retrieval and forwarding utility designed for use over on-demand TCP/IP links, such as SLIP or PPP connections. It supports various remote-mail protocols including POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC for mail retrieval. Fetchmail then forwards the retrieved mail through SMTP, allowing users to read it using their preferred mail clients. The recent vulnerability affects the NTLM authentication mechanism, posing a risk to users relying on this feature.
Vulnerability Detail
The vulnerability identified as CVE-2026-94184 is a stack-based buffer overflow that occurs during NTLM authentication in Fetchmail. This flaw can potentially allow an attacker to execute arbitrary code or cause a denial of service by sending specially crafted requests to the Fetchmail service. The vulnerability arises from improper handling of input data, which can lead to memory corruption. The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
0:6.4.24-1.el9_8.1
This is the first release that contains the fix.
sudo dnf update fetchmailTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling NTLM authentication in their Fetchmail configuration until the package is updated. This can be done by modifying the .fetchmailrc configuration file and removing or commenting out any lines that specify NTLM authentication.
Conclusion
The Fetchmail vulnerability CVE-2026-94184 poses a moderate risk due to a stack-based buffer overflow in NTLM authentication. Users are advised to update to the latest version to mitigate this risk. Temporary workarounds are available, but updating is the best long-term solution.
See every vulnerability recorded for fetchmail →
FAQ
The vulnerability is a stack-based buffer overflow that affects NTLM authentication, which can lead to arbitrary code execution or denial of service.
You can check your version of Fetchmail by running 'fetchmail --version' in your terminal. If it is below 0:6.4.24-1.el9_8.1, it is vulnerable.
If an immediate update is not possible, consider disabling NTLM authentication as a temporary workaround.
More details can be found on the CVE page for CVE-2026-94184, which provides in-depth information about the vulnerability and its impact.
Vulert monitors and alerts for open-source vulnerabilities in software by analyzing a manifest file like package-lock.json, allowing users to stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for fetchmail.
