CVE-2021-36386
HIGH 7.5 ALL-YEARSreport_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.
Severe if exploited (CVSS 7.5), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
2.6%chance of exploitation in 30 days · 85th percentile
Impact if exploited
7.5CVSS 3.1 · HIGH · NVD
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
- CWE-909: Missing Initialization of Resource
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References and research data (JSON)
Vendor product assessments
fetchmail-0:6.4.24-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
fetchmail-0:6.4.24-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
fetchmail-0:6.4.24-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
fetchmail-0:6.4.24-1.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=src
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
fetchmail-0:6.4.24-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
fetchmail-debuginfo-0:6.4.24-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
fetchmail-debuginfo-0:6.4.24-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
fetchmail-debuginfo-0:6.4.24-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
fetchmail-debuginfo-0:6.4.24-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
fetchmail-debugsource-0:6.4.24-1.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=aarch64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
fetchmail-debugsource-0:6.4.24-1.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=ppc64le
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
fetchmail-debugsource-0:6.4.24-1.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=s390x
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
fetchmail-debugsource-0:6.4.24-1.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed
Vendor assessment for this product only.
pkg:rpm/redhat/[email protected]?arch=x86_64
- vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
fetchmail as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/fetchmail?arch=src
- no fix planned: Out of support scope
fetchmail as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/fetchmail?arch=src
- no fix planned: Out of support scope
fetchmail as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/fetchmail?arch=src
Red Hat · CVE-2021-36386 · Updated 2025-11-21T15:53:59+00:00
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Fetchmail | Fetchmail | < 6.4.20 |
| Fedoraproject | Fedora | 33 |
| Fedoraproject | Fedora | 34 |
All CVSS metrics
- HIGH 7.5 v3.1 · NVD Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - MEDIUM 5 v2.0 · NVD Primary
AV:N/AC:L/Au:N/C:N/I:N/A:P
References
Patches & mitigations
- http://www.openwall.com/lists/oss-security/2021/07/28/5 CVE record · mitre · Updated 2022-09-25T15:07:03.000Z
CVE record · CVE · Updated 2024-08-04T00:54:51.476Z
NVD · CVE-2021-36386 · Updated 2026-06-17T03:58:47.220
Advisories
- https://www.fetchmail.info/security.html CVE record · mitre · Updated 2022-09-25T15:07:03.000Z
CVE record · CVE · Updated 2024-08-04T00:54:51.476Z
NVD · CVE-2021-36386 · Updated 2026-06-17T03:58:47.220 - https://www.fetchmail.info/fetchmail-SA-2021-01.txt CVE record · mitre · Updated 2022-09-25T15:07:03.000Z
CVE record · CVE · Updated 2024-08-04T00:54:51.476Z
NVD · CVE-2021-36386 · Updated 2026-06-17T03:58:47.220
Red Hat · CVE-2021-36386 · Updated 2025-11-21T15:53:59+00:00 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIXKO6QW3AUHGJVWKJXBCOVBYJUJRBFC/ CVE record · mitre · Updated 2022-09-25T15:07:03.000Z
CVE record · CVE · Updated 2024-08-04T00:54:51.476Z
NVD · CVE-2021-36386 · Updated 2026-06-17T03:58:47.220 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGYO5AHSXTCKA4NQC2Z4H3XMMYNAGC77/ CVE record · mitre · Updated 2022-09-25T15:07:03.000Z
CVE record · CVE · Updated 2024-08-04T00:54:51.476Z
NVD · CVE-2021-36386 · Updated 2026-06-17T03:58:47.220 - https://security.gentoo.org/glsa/202209-14 CVE record · mitre · Updated 2022-09-25T15:07:03.000Z
CVE record · CVE · Updated 2024-08-04T00:54:51.476Z
NVD · CVE-2021-36386 · Updated 2026-06-17T03:58:47.220 - https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-36386.json Red Hat · CVE-2021-36386 · Updated 2025-11-21T15:53:59+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-23001 EUVD · EUVD-2021-23001
Technical & other
- http://www.openwall.com/lists/oss-security/2021/08/09/1 CVE record · mitre · Updated 2022-09-25T15:07:03.000Z
CVE record · CVE · Updated 2024-08-04T00:54:51.476Z
NVD · CVE-2021-36386 · Updated 2026-06-17T03:58:47.220 - https://access.redhat.com/security/cve/CVE-2021-36386 Red Hat · CVE-2021-36386 · Updated 2025-11-21T15:53:59+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=1987766 Red Hat · CVE-2021-36386 · Updated 2025-11-21T15:53:59+00:00
- https://www.cve.org/CVERecord?id=CVE-2021-36386 Red Hat · CVE-2021-36386 · Updated 2025-11-21T15:53:59+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2021-36386 Red Hat · CVE-2021-36386 · Updated 2025-11-21T15:53:59+00:00
- https://access.redhat.com/errata/RHSA-2022:1964 Red Hat · CVE-2021-36386 · Updated 2025-11-21T15:53:59+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS