CVE-2026-43862
Low · 3.7CVSS
3.7
EPSS
0.3%
Published
May 4, 2026
CISA due date
—
The record
In mutt before 2.3.2, the imap_auth_gss security level is mishandled.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | mutt | 0 | 2.2.16-160000.2.1 |
| openSUSE:Tumbleweed | mutt | 0 | 2.3.2-1.1 |
Related vulnerabilities
- CVE-2026-43863 mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c. Also affects mutt
- CVE-2026-43864 mutt before 2.3.2 has a show_sig_summary NULL pointer dereference. Also affects mutt
- CVE-2026-43859 mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5… Also affects mutt
- CVE-2026-43860 mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5… Also affects mutt
- CVE-2026-43861 mutt before 2.3.2 does not check for '\0' in url_pct_decode. Also affects mutt
- CVE-2014-9116 The write_one_header function in mutt 1.5.23 does not properly handle newline characters… Also affects mutt
- CVE-2026-109282 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in… CWE-843
- CVE-2026-106587 In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes… CWE-843