https://seclists.org/oss-sec/2025/q4/10: fetchmail-SA-2025-01: SMTP AUTH denial of service now called CVE-2025-61962.
Published Oct 4, 2025
·Updated
Affected Software
1 affected component
Fetchmail Fetchmail
Frequently Asked Questions
1
Which deployments are exposed to this issue?
The issue affects Fetchmail SMTP client use during authentication, but only in certain configurations. The available advisory information does not identify the specific affected configuration or state whether it is enabled by default.
2
What must an attacker be able to do to trigger the denial of service?
An attacker must be able to supply network input to Fetchmail during SMTP authentication. Insufficient validation of that input can cause Fetchmail to attempt a read from address 1 and crash.
3
How can I recognize a possible occurrence?
A potentially related event would be a Fetchmail crash while performing SMTP authentication, particularly where crash diagnostics indicate an attempted read from address 1. The provided information does not include a more specific detection method or log signature.