Low severity3.7NVD Advisory· Published May 4, 2026· Updated May 11, 2026

CVE-2026-43964

Description

Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.

Affected products

Postfix/Postfix
cpe:2.3:a:postfix:postfix:*:*:*:*:*:*:*:*
Range: <3.8.16

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.openwall.com/lists/oss-security/2026/05/04/30nvdMailing ListThird Party Advisory
www.mail-archive.com/postfix-announce@postfix.org/msg00110.htmlnvdMailing ListThird Party Advisory

News mentions

Patch Tuesday - May 2026
Rapid7 Blog · May 13, 2026

cvss	0.240
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000