RLSA-2026:98480: Moderate: fetchmail security update
Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.
Security Fix(es):
fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/fetchmailto a version that resolves this vulnerability.Fixed in 0:6.4.24-1.el9_8.1
Event History
Frequently Asked Questions
What access does an attacker need to attempt exploitation?
The CVSS vector indicates the issue is remotely reachable over the network and does not require attacker privileges or user interaction. Exploitation is rated low complexity.
Which fetchmail functionality is relevant to exposure?
The overflow occurs in NTLM authentication. Systems using fetchmail should determine whether their configured mail retrieval workflows use NTLM authentication.
What is the stated security impact?
The CVSS vector indicates a low availability impact, with no stated confidentiality or integrity impact. The underlying flaw is a stack-based buffer overflow.