CVE-2026-94184: Stack-based buffer overflow in fetchmail NTLM authentication
Summary
ALSA-2026:86981: A stack-based buffer overflow in NTLM authentication can compromise the security of systems using the affected mail retrieval utility. Affects fetchmail versions < 6.4.24-1.el9_8.1. Fixed in 6.4.24-1.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fetchmail is a remote mail retrieval and forwarding utility in the AlmaLinux:9 ecosystem. It retrieves messages from remote mail servers using protocols including POP, IMAP, and ESMTP ETRN, then forwards them through SMTP. It is intended for on-demand TCP/IP connections and lets users read retrieved mail through their preferred mail client.
Vulnerability Detail
The stack-based buffer overflow in fetchmail's NTLM authentication can affect systems running the vulnerable package. The advisory identifies the issue as fetchmail-SA-2026-01 and relates it to CVE-2026-94184. The supplied details do not specify the precise attacker prerequisites or resulting impact beyond the buffer overflow, and a CVSS score is not published in the supplied information.
How To Fix
Minimum fixed version
6.4.24-1.el9_8.1
This is the first release that contains the fix.
sudo dnf update fetchmailTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
AI-generated workaround (not vendor-documented): Restrict fetchmail's access to remote mail servers that require NTLM authentication until the package can be upgraded. The supplied advisory does not document a workaround.
Conclusion
Upgrade fetchmail to 6.4.24-1.el9_8.1 on AlmaLinux:9. The advisory identifies a stack-based buffer overflow in NTLM authentication, while the supplied details do not publish a CVSS score or a documented workaround. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for fetchmail →
FAQ
The supplied AlmaLinux:9 advisory lists fetchmail as affected from version 0, with the affected range ending at the fixed release.
CVE-2026-94184 is a stack-based buffer overflow in fetchmail's NTLM authentication; the supplied details do not specify further impact.
Upgrade fetchmail to the minimum fixed version 6.4.24-1.el9_8.1 for AlmaLinux:9.
Restrict fetchmail's access to remote servers requiring NTLM authentication; this is an AI-generated mitigation, not a documented workaround.
Check the application's manifest or SBOM for fetchmail. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for fetchmail.
