CVE-2021-36386 is a denial-of-service vulnerability affecting Fetchmail versions prior to 6.4.20, specifically within the report_vbuild function, due to uninitialized vsnprintf va_list arguments. This flaw could allow malicious mail servers to trigger a denial of service or other unspecified impacts through crafted long error messages. With a CVSS score of 7.5 (HIGH), it is a network-exploitable vulnerability with low attack complexity, requiring no privileges or user interaction, leading to high availability impact. There is currently no evidence of active exploitation, no public exploit code available, and minimal community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 6.4.20CPE matchmatch criteria | cpe:2.3:a:fetchmail:fetchmail:*:*:*:*:*:*:*:* | ||
33CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | ||
34CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
fetchmail: DoS or information disclosure when logging long messages
Jul 28, 2021report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.
Jul 13, 2021