RLSA-2026:98583: Moderate: fetchmail security update
Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.
Security Fix(es):
fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/fetchmail-debuginfoto a version that resolves this vulnerability.Fixed in 0:6.4.38-3.el10_2.1 - Upgrade
Upgrade
rocky-linux/fetchmail-debugsourceto a version that resolves this vulnerability.Fixed in 0:6.4.38-3.el10_2.1 - Upgrade
Upgrade
rocky-linux/fetchmailto a version that resolves this vulnerability.Fixed in 0:6.4.38-3.el10_2.1
Event History
Frequently Asked Questions
Which Rocky Linux packages are included in this update?
The update covers rocky-linux/fetchmail, rocky-linux/fetchmail-debuginfo, and rocky-linux/fetchmail-debugsource.
What is the reported impact of this issue?
The issue is a stack-based buffer overflow in Fetchmail NTLM authentication. The supplied CVSS vector indicates network reachability with no privileges or user interaction required, and availability impact is rated low; confidentiality and integrity impact are rated none.