Moderate Vulnerability in Fetchmail: Stack-Based Buffer Overflow in NTLM Authentication
Summary
RLSA-2026:86982: Moderate: fetchmail security update. Affects fetchmail versions < 0:6.4.24-1.el8_10.1. Fixed in 0:6.4.24-1.el8_10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fetchmail is a remote mail retrieval and forwarding utility designed for use over on-demand TCP/IP links, such as SLIP or PPP connections. It supports various remote mail protocols including POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC for mail retrieval. Fetchmail then forwards the retrieved mail through SMTP, allowing users to access their emails via their preferred mail client. This utility is widely used for its versatility and compatibility with multiple protocols.
Vulnerability Detail
The vulnerability identified in Fetchmail is a stack-based buffer overflow that occurs during NTLM authentication. This flaw can potentially allow an attacker to execute arbitrary code on the affected system, leading to unauthorized access or data breaches. The vulnerability is cataloged under CVE-2026-94184 and has a CVSS score of 5.3, indicating a moderate severity level. The issue arises from improper handling of input data, which can overflow the buffer and overwrite adjacent memory.
How To Fix
Minimum fixed version
0:6.4.24-1.el8_10.1
This is the first release that contains the fix.
sudo dnf update fetchmailTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable NTLM authentication in their Fetchmail configuration. This can be done by modifying the .fetchmailrc file and ensuring that NTLM is not specified as an authentication method.
Conclusion
The Fetchmail vulnerability, identified as a stack-based buffer overflow during NTLM authentication, poses a moderate risk to users. It is crucial to update to the patched version to safeguard against potential exploits. Users can also utilize Vulert to monitor their applications for vulnerabilities effectively.
See every vulnerability recorded for fetchmail →
FAQ
The vulnerability is a stack-based buffer overflow that occurs during NTLM authentication, potentially allowing arbitrary code execution.
You can check your Fetchmail version by running 'fetchmail --version' in your terminal. If it is below 0:6.4.24-1.el8_10.1, it is vulnerable.
As a temporary measure, you can disable NTLM authentication in your Fetchmail configuration to mitigate the risk.
More details about the CVE-2026-94184 can be found on the official CVE website or security advisories related to Fetchmail.
Vulert monitors and alerts for open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for fetchmail.
