CVE-2026-43964

Name	CVE-2026-43964
Description	Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1135718

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
postfix (PTS)	bullseye	3.5.25-0+deb11u1	vulnerable
	bookworm	3.7.11-0+deb12u1	vulnerable
	trixie	3.10.5-1~deb13u1	vulnerable
	forky	3.11.0-4	vulnerable
	sid	3.11.2-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
postfix	source	(unstable)	3.11.2-1			1135718

https://www.mail-archive.com/postfix-announce@postfix.org/msg00110.html
https://www.openwall.com/lists/oss-security/2026/05/04/25