CVE catalog

CVE-2021-35525

postsrsd: CVE-2021-35525

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.65% · Oct 25, 2026

PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated email addresses. NOTE: the PostSRSd maintainer acknowledges "theoretically, this error should never occur ... I'm not sure if there's a reliable way to trigger this condition by an external attacker, but it is a security bug in PostSRSd nevertheless."

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpostsrsdsid2.4.1-1fixed
Debianpostsrsdforky2.4.1-1fixed
Debianpostsrsdtrixie1.10-2.2fixed
Debianpostsrsdbookworm1.10-2fixed
Ubuntupostsrsd16.041.2-1vulnerable
Ubuntupostsrsd18.041.4-1vulnerable
Ubuntupostsrsd18.041.4-1ubuntu0.1vulnerable
Ubuntupostsrsd20.041.5-2vulnerable
Ubuntupostsrsd22.041.10-2vulnerable
Ubuntupostsrsd24.041.10-2vulnerable
Ubuntupostsrsd24.041.10-2.1build1vulnerable
Ubuntupostsrsd25.101.10-2.2vulnerable
Ubuntupostsrsd26.041.10-2.2vulnerable
Ubuntupostsrsd26.042.0.11-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpostsrsdsourcesid1.10-2not yet assignedNot reported[990439]
Debianpostsrsdsourceforky1.10-2not yet assignedNot reported[990439]
Debianpostsrsdsourcetrixie1.10-2not yet assignedNot reported[990439]
Debianpostsrsdsourcebookworm1.10-2not yet assignedNot reported[990439]

[Debian bug #990439]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [postsrsd]Fixed

    Source package: [postsrsd]

    Details (2)

    • 1.10-2+b1 · amd64 · bookworm

      Fixed · Fixed: 1.10-2

      dsa · postsrsd · debian · bookworm; dsa · postsrsd · debian · 12

    • 1.10-2+b1 · arm64 · bookworm

      Fixed · Fixed: 1.10-2

      dsa · postsrsd · debian · bookworm; dsa · postsrsd · debian · 12

[Debian 13 (Trixie)]

  • [postsrsd]Fixed
    Details (2)

    • 1.10-2.2 · amd64 · trixie

      Fixed · Fixed: 1.10-2

      dsa · postsrsd · debian · 13

    • 1.10-2.2 · arm64 · trixie

      Fixed · Fixed: 1.10-2

      dsa · postsrsd · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]