CVE-2026-43860
Low · 3.7CVSS
3.7
EPSS
0.3%
Published
May 4, 2026
CISA due date
—
The record
mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | mutt | 0 | 2.2.16-160000.2.1 |
Related vulnerabilities
- CVE-2026-43863 mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c. Also affects mutt
- CVE-2026-43864 mutt before 2.3.2 has a show_sig_summary NULL pointer dereference. Also affects mutt
- CVE-2026-43859 mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5… Also affects mutt
- CVE-2026-43862 In mutt before 2.3.2, the imap_auth_gss security level is mishandled. Also affects mutt
- CVE-2026-43861 mutt before 2.3.2 does not check for '\0' in url_pct_decode. Also affects mutt
- CVE-2026-42618 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in… CWE-193
- CVE-2026-106584 In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times… CWE-193
- CVE-2026-90781 alsa-lib through 1.2.16.1 contains a stack buffer overflow in the… CWE-193