CVE-2026-43863
Low · 3.7CVSS
3.7
EPSS
0.3%
Published
May 4, 2026
CISA due date
—
The record
mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | mutt | 0 | 2.2.16-160000.2.1 |
| openSUSE:Tumbleweed | mutt | 0 | 2.3.2-1.1 |
Related vulnerabilities
- CVE-2026-43864 mutt before 2.3.2 has a show_sig_summary NULL pointer dereference. Also affects mutt
- CVE-2026-43859 mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5… Also affects mutt
- CVE-2026-43862 In mutt before 2.3.2, the imap_auth_gss security level is mishandled. Also affects mutt
- CVE-2026-43860 mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5… Also affects mutt
- CVE-2026-43861 mutt before 2.3.2 does not check for '\0' in url_pct_decode. Also affects mutt
- CVE-2014-9116 The write_one_header function in mutt 1.5.23 does not properly handle newline characters… Also affects mutt
- CVE-2026-15686 Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution… CWE-253
- CVE-2026-59847 A flaw was found in libssh. CWE-253