ALSA-2026:86982: Moderate: fetchmail security update

Q: Which deployments are exposed to this issue?

Deployments using Fetchmail that perform NTLM authentication are relevant to this vulnerability. The available information does not state whether NTLM authentication is enabled by default.

Q: What condition is required for exploitation?

The flaw is a stack-based buffer overflow in Fetchmail's NTLM authentication handling. Exploitation therefore requires interaction with the NTLM authentication path; the provided information does not specify the attacker's required access level or the exact malicious input.

Q: How can I determine whether my environment is affected?

Identify systems running the AlmaLinux Fetchmail package and determine whether they use NTLM authentication. Compare the installed package against the security update referenced by ALSA-2026:86982; no fixed version is provided in the available data.

Published Oct 21, 2026

Updated

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.

Security Fix(es):

fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

almalinux/fetchmail<6.4.24-1.el8_10.1

6.4.24-1.el8_10.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/fetchmail to a version that resolves this vulnerability.
Fixed in 6.4.24-1.el8_10.1

Event History

Oct 21, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-94184

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Fetchmail that perform NTLM authentication are relevant to this vulnerability. The available information does not state whether NTLM authentication is enabled by default.

What condition is required for exploitation?

The flaw is a stack-based buffer overflow in Fetchmail's NTLM authentication handling. Exploitation therefore requires interaction with the NTLM authentication path; the provided information does not specify the attacker's required access level or the exact malicious input.

How can I determine whether my environment is affected?

Identify systems running the AlmaLinux Fetchmail package and determine whether they use NTLM authentication. Compare the installed package against the security update referenced by ALSA-2026:86982; no fixed version is provided in the available data.

ALSA-2026:86982: Moderate: fetchmail security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What condition is required for exploitation?

How can I determine whether my environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What condition is required for exploitation?

How can I determine whether my environment is affected?