https://seclists.org/oss-sec/2026/q3/701: Postfix: SMTP smuggling, mote crash, and hardening fixes in 3.11.7 and lated legacy leases
Published Sep 10, 2026
·Updated
Affected Software
2 affected components
Postfix Postfix>=3.5<=3.11.7
Postfix>=3.10.14<=3.11.7
Frequently Asked Questions
1
Which Postfix release lines have updates available for these fixes?
Updated releases are available for supported Postfix versions 3.8 through 3.11. The announcement specifically identifies 3.11.7, 3.10.14, and 3.9.15, and states that fixes are also in unstable postfix-3.12-20260902.
2
What should operators of out-of-support Postfix versions do?
Releases will be available for versions 3.5 through 3.7, but they do not include the June 2026 patches for large SMTP inputs and TLSA parsing. Those earlier patches still need to be applied separately.