Known vulnerabilities in Postfix

Software: Postfix
Software CPE: cpe:2.3:a:postfix_org:postfix:*:*:*:*:*:*:*:*
Total vulnerabilities: 13
Public exploits: 3
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Postfix Postfix is affected by 13 known vulnerabilities: 9 medium, 4 low Critical High Medium Low

Vulnerabilities (13)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU131864 - Out-of-bounds read
CVE-2026-43964
CWE-125 Medium
No
No
3.8.17, 3.9.11, 3.10.10, 3.11.3 19.05.2026 SB2026051936
SB2026051940
SB2026051941
and 19 more
#VU110629 - Missing release of memory after effective lifetime
CVE-2008-3889
CWE-401 Low
No
No
2.4.9, 2.5.5 08.06.2025 SB2008091201
SB2008091901
#VU110628 - Exposure of sensitive information to an unauthorized actor
CVE-2008-2937
CWE-200 Low
No
No
2.5.4 08.06.2025 SB2008081803
SB2008081401
#VU110627 - UNIX Hard Link
CVE-2008-2936
CWE-62 Low
Available
No
2.3.15, 2.4.8, 2.5.4 08.06.2025 SB2008081803
SB2008081401
#VU110626 - Protection Mechanism Failure
CVE-2005-0337
CWE-693 Medium
No
No
2.1.4 08.06.2025 SB2005050224
#VU110625 - Improper input validation
CVE-2003-0540
CWE-20 Medium
Available
No
1.1.13 08.06.2025 SB2003082707
#VU110624 - Improper input validation
CVE-2003-0468
CWE-20 Medium
No
No
1.1.12 08.06.2025 SB2003082706
#VU110623 - Resource exhaustion
CVE-2001-0894
CWE-400 Medium
No
No
20010228-pl07 08.06.2025 SB2001111101
#VU84727 - Command injection
CVE-2023-51764
CWE-77 Medium
Available
No
3.5.23, 3.6.13, 3.7.9, 3.8.4 24.12.2023 SB2023122403
SB2023122615
SB2023122811
and 11 more
#VU34425 - Insufficient Verification of Data Authenticity
CVE-2020-12063
CWE-345 Medium
No
No
- 24.04.2020 SB2020042431
#VU7062 - Uncontrolled Search Path Element
CWE-427 Low
No
No
2.11.10, 3.0.10, 3.1.6, 3.2.2 14.06.2017 SB2017061403
SB2017092609
#VU45044 - Memory corruption
CVE-2011-1720
CWE-119 Medium
No
No
- 13.05.2011 SB2011051302
SB2012062501
#VU32859 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
CVE-2011-0411
CWE-300 Medium
No
No
2.4.16 17.03.2011 SB2011031701
SB2011032503
SB2012062501
and 1 more