Loading story…
qmail has been hit by multiple remote code execution issues spanning legacy and actively maintained codebases. Qualys reported that CVE-2005-1513, long believed unexploitable in default installations, can be triggered remotely through qmail-local on Debian’s default qmail package by sending a nearly 4 GB mail header that causes an integer overflow in stralloc_readyplus, leading to a large buffer overflow and arbitrary command execution as any non-root local user. The same research also identified CVE-2020-3811, a recipient verification bypass in the bundled qmail-verify component, and CVE-2020-3812, a local information disclosure issue tied to privileged file existence checks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A pull request addressing remote code execution via shell injection in qmail-remote's TLS error handler was merged into the main branch. The visible content indicates the merge occurred on April 7, 2026.
In the same advisory, Qualys said it published a patch for Debian's qmail package and noted that notqmail developers had also produced fixes for the legacy qmail issues. The advisory additionally recommended mitigations such as low memory limits and message size restrictions.
Qualys reported that three qmail vulnerabilities originally disclosed in 2005 remained unfixed and that CVE-2005-1513 was remotely exploitable in a default Debian qmail installation via qmail-local. The advisory also described CVE-2020-3811 and CVE-2020-3812 in the Debian-packaged qmail-verify component.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Openfind **MailGates/MailAudit** and **Sagredo qmail** were disclosed with critical remote code execution vulnerabilities that could let attackers compromise exposed mail infrastructure. **CVE-2026-6350** affects Openfind MailGates/MailAudit and is a stack-based buffer overflow (`CWE-121`) that allows an unauthenticated remote attacker to control execution flow and run arbitrary code. The flaw carries a **CVSS v3.1** score reflecting network exploitation with no privileges or user interaction and high impact across confidentiality, integrity, and availability, and was referenced in advisories published by **TWCERT/CC**. A second flaw, **CVE-2026-41113**, affects **Sagredo qmail** versions before `2026.04.07` and enables remote code execution through `tls_quit` because `qmail-remote.c` uses `popen` in the `notlshosts_auto` component, a command injection issue tracked as `CWE-78`. The vulnerability was documented with references to public research, a GitHub publications repository, the fixing commit, pull request `#42`, and the patched `v2026.04.07` release, giving defenders a clear remediation path while underscoring the risk to internet-facing email systems.
Jun 29, 2026
A **remote code execution** flaw tracked as **`CVE-2026-41113`** was disclosed in the `sagredo-dev/qmail` fork after researchers found that `qmail-remote` could build and execute a shell command from an attacker-controlled MX hostname. The bug sits in `tls_quit()` and was introduced by the `notlshosts_auto` feature added in October 2024, which automatically records hosts that fail TLS. If a target mail server sends mail to a domain whose DNS MX record is controlled by an attacker, a crafted hostname containing shell metacharacters can be passed through `sprintf()` into `popen()`, allowing arbitrary commands to run as the **`qmailr`** user when `control/notlshosts_auto` is enabled. The issue affects `sagredo-dev/qmail` versions **`v2024.10.26` through `v2026.04.02`** and was fixed in **`v2026.04.07`** by commit **`749f607`**, which removes shell execution, adds stricter FQDN validation, and replaces the vulnerable logic with safer file handling using `open()` and `snprintf()`. Public writeups and a GitHub repository published technical analysis, a Docker-based reproduction environment, and proof-of-concept exploit material showing the chain from crafted DNS responses to command execution, with one example writing `id` output to `/tmp/qmail_rce_proof`. The vulnerability carries a reported **CVSS 3.1 score of 8.2 (High)**, and maintainers advised users of the community-patched qmail fork—not original `qmail 1.03`—to upgrade immediately.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in mail server software that allow **unauthenticated remote code execution** through crafted SMTP input. `CVE-2019-25646` affects **Tabs Mail Carrier 2.5.1**, where an oversized `MAIL FROM` parameter triggers a **buffer overflow** on the SMTP service listening on port 25. The flaw can overwrite the `EIP` register and enable execution of attacker-controlled payloads, including a bind shell, giving remote attackers a direct path to code execution. A second flaw, `CVE-2025-71275`, affects **Zimbra Collaboration Suite 8.8.15** in the **PostJournal** service. In that case, improper sanitization of the SMTP `RCPT TO` parameter allows **command injection** via shell expansion syntax, leading to arbitrary command execution under the Zimbra service account. Both issues were classified with high impact across confidentiality, integrity, and availability, underscoring the risk posed by exposed SMTP services that process untrusted sender and recipient fields without adequate bounds checking or input sanitization.
Jun 29, 2026