https://seclists.org/oss-sec/2025/q4/7: fetchmail-SA-2025-01: SMTP AUTH denial of service
Published Oct 3, 2025
·Updated
Affected Software
1 affected component
Fetchmail Fetchmail<=6.5.5, >=7.0.0
Fetchmail releases through 6.5.5 and 7.0.0 pre-releases are affected. Fetchmail 6.5.6 and newer are listed as not affected; the correction is also available in Git commit 4c3cebfa4e659fb778ca2cae0ccb3f69201609a8.
Fetchmail defaults to using the SMTP server on localhost and does not attempt authentication unless it is configured to do so. The affected path requires SMTP AUTH, so configurations that do not attempt authentication do not use that path.
The client must be authenticating through SMTP AUTH. The advisory characterizes the issue as insufficient validation of network input in certain configurations and states that Fetchmail can try to read from address 1 and crash.