Security update for mutt
This update for mutt fixes the following issue: - CVE-2026-107570: heap out-of-bounds write in `convert_file_from_to()` via a crafted `Content-Type` header (bsc#1284739).
- Update to 2.2.16-160000.3.1
Published Updated
PatchFirst · Latest vulnerabilities
mutt vulnerabilities
Vulnerability published for mutt in the last 30 days: 1. Listed in the KEV catalogue: 0.
Vulnerabilities: 2
Security update for mutt
This update for mutt fixes the following issues - CVE-2026-43859: `strfcpy` used instead of `memcpy` for the IMAP `auth_cram` MD5 digest (bsc#1263897). - CVE-2026-43860: truncation of `hash_passwd` by one byte for IMAP `auth_cram` MD5 digest (bsc#1263896). - CVE-2026-43861: missing check for `\0` in `url_pct_decode` (bsc#1263895). - CVE-2026-43862: mishandling of the `imap_auth_gss` security level (bsc#1263894). - CVE-2026-43863: infinite loop in `data_object_to_stream` in `crypt-gpgme.c` (bsc#1263893). - CVE-2026-43864: NULL pointer dereference in function `show_sig_summary` (bsc#1263892).
- Update to 2.2.16-160000.2.1
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.