onyx --cves cve-2026-43964
CVE-2026-43964
- score
- <0.1
- cvss
- 3.7
- epss
- 0.9%
- published
- 2026-05-04
- kev added
- —
- first seen
Postfix < 3.8.16, 3.9 < 3.9.10, and 3.10 < 3.10.9 contain a buffer over-read caused by enhanced status codes lacking text after the third number, letting attackers cause process crash remotely, exploit requires crafted status code.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 13
- https://www.mail-archive.com/postfix-announce@postfix.org/msg00110.html
- http://www.openwall.com/lists/oss-security/2026/05/04/30
- https://access.redhat.com/errata/RHSA-2026:25930
- https://access.redhat.com/errata/RHSA-2026:25932
- https://access.redhat.com/errata/RHSA-2026:26205
- https://bugzilla.redhat.com/show_bug.cgi?id=2466488
- https://access.redhat.com/errata/RHSA-2026:50963
- https://access.redhat.com/errata/RHSA-2026:50964
- https://access.redhat.com/security/cve/CVE-2026-43964
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43964.json
- https://access.redhat.com/errata/RHSA-2026:51034
- https://access.redhat.com/errata/RHSA-2026:51436
- https://access.redhat.com/errata/RHSA-2026:57174