https://seclists.org/oss-sec/2025/q4/7: fetchmail-SA-2025-01: SMTP AUTH denial of service
Published Oct 3, 2025
·Updated
Affected Software
1 affected component
Fetchmail Fetchmail<=6.5.5, >=7.0.0
Frequently Asked Questions
1
Which releases need to be updated?
Fetchmail releases through 6.5.5 and 7.0.0 pre-releases are affected. Fetchmail 6.5.6 and newer are listed as not affected; the correction is also available in Git commit 4c3cebfa4e659fb778ca2cae0ccb3f69201609a8.
2
Is a default Fetchmail configuration exposed?
Fetchmail defaults to using the SMTP server on localhost and does not attempt authentication unless it is configured to do so. The affected path requires SMTP AUTH, so configurations that do not attempt authentication do not use that path.
3
What configuration condition is needed for the crash to occur?
The client must be authenticating through SMTP AUTH. The advisory characterizes the issue as insufficient validation of network input in certain configurations and states that Fetchmail can try to read from address 1 and crash.