A buffer over-read vulnerability (CVE-2026-43964, CVSS 3.7) in Postfix allows a remote attacker to trigger a crash via a malformed enhanced status code. The vulnerability affects Postfix versions prior to 3.8.16, versions 3.9.0 through 3.9.9, and versions 3.10.0 through 3.10.8. Red Hat has released patched packages for its supported Enterprise Linux 8.6 streams; users of upstream Postfix should upgrade to version 3.8.16, 3.9.10, or 3.10.9.
Red Hat Product Errata RHSA-2026:50963 - Security Advisory Issued: 2026-08-06 Updated: 2026-08-06 RHSA-2026:50963 - Security Advisory Overview Updated Packages Synopsis Important: postfix security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for postfix is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS. Security Fix(es): postfix: buffer over-read via malformed enhanced status code (CVE-2026-43964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.6 x86_64 Red Hat Enterprise Linux Server - AUS 8.6 x86_64 Fixes BZ - 2466488 - CVE-2026-43964 postfix: buffer over-read via malformed enhanced status code CVEs CVE-2026-43964 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.6 SRPM postfix-3.5.8-4.el8_6.1.src.rpm SHA-256: 91b20e66f52e60169e5c9430e6c78a837135e3a8f1fdaaf4c496b698b77550f3 x86_64 postfix-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: b5299ebc062b3a0b652c95f40f795cdd5beb18d879596ef1d721a24fb08c639a postfix-cdb-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 8cc3237c379e3e6587b03163c13f57e4800ead5c64b9993793b32d6baf0da1be postfix-cdb-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: eef80269cfc6e5eaf80a6de2eeeee022aa00e20b63b84309fe6a45a030f25dfb postfix-cdb-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: eef80269cfc6e5eaf80a6de2eeeee022aa00e20b63b84309fe6a45a030f25dfb postfix-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: ded830a22ff872ba8931fb4aa544d3e08afc7be92d218dd91fed5a2b87c9b1ad postfix-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: ded830a22ff872ba8931fb4aa544d3e08afc7be92d218dd91fed5a2b87c9b1ad postfix-debugsource-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 04a904c072f99302f44a367455cf8585a98850e4aa6c734e6018fb84d25ba1a5 postfix-debugsource-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 04a904c072f99302f44a367455cf8585a98850e4aa6c734e6018fb84d25ba1a5 postfix-ldap-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 7b6017472c1bd46167c7ae12f7504d2e6ce9d8155f0db8d7d39931dac0ee22b7 postfix-ldap-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 4d35ddadcef360aac22a774824ce20b3cf0d052f92f06bbda222927d74700943 postfix-ldap-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 4d35ddadcef360aac22a774824ce20b3cf0d052f92f06bbda222927d74700943 postfix-lmdb-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: e56c5b496a47e579d941b8c28cd386fca2045bcaaa8f0ad22d1ad81fdb589391 postfix-lmdb-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: e56c5b496a47e579d941b8c28cd386fca2045bcaaa8f0ad22d1ad81fdb589391 postfix-mysql-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: c8c8c987332f7b56630658bf9bfca09fcc30fd659a16a218f00ca602204f145c postfix-mysql-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 525eab76891e10bf54f5533c63b272df5664685029f02584dfae48f5cdd8dee2 postfix-mysql-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 525eab76891e10bf54f5533c63b272df5664685029f02584dfae48f5cdd8dee2 postfix-pcre-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 6d1c23153cead11292e620ac6a9124ec349b4b17b4fae735d2ab2a0aaba8cf5d postfix-pcre-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: bdb8f60a29f3e2af8e67f3ae4a27bd2f8c9352f579e25ab8536823ce5eff745b postfix-pcre-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: bdb8f60a29f3e2af8e67f3ae4a27bd2f8c9352f579e25ab8536823ce5eff745b postfix-perl-scripts-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: eab46e3feeb8d818eb7cd20fbcd2c72a993c62521904edfc9aed6eef41d9bd47 postfix-pgsql-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: c1b4e15ef2ea0154f84c3e96e08214753bfa0d142239d68d62342a02d8bf9e6a postfix-pgsql-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: ed24fe07d2e25c71fe0df23cbba745c107a4bd93a831537e3eda1709dc84ac22 postfix-pgsql-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: ed24fe07d2e25c71fe0df23cbba745c107a4bd93a831537e3eda1709dc84ac22 postfix-sqlite-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: dc96d5c5c2212df3ce6f7b003b10a1ee79e334a0a7e1ef11e75160c0a52547b0 postfix-sqlite-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: bbaf988ff4877eb1ba1187253b012ed8b6da7ff9f0fabba1d23d22b9e638c659 postfix-sqlite-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: bbaf988ff4877eb1ba1187253b012ed8b6da7ff9f0fabba1d23d22b9e638c659 Red Hat Enterprise Linux Server - AUS 8.6 SRPM postfix-3.5.8-4.el8_6.1.src.rpm SHA-256: 91b20e66f52e60169e5c9430e6c78a837135e3a8f1fdaaf4c496b698b77550f3 x86_64 postfix-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: b5299ebc062b3a0b652c95f40f795cdd5beb18d879596ef1d721a24fb08c639a postfix-cdb-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 8cc3237c379e3e6587b03163c13f57e4800ead5c64b9993793b32d6baf0da1be postfix-cdb-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: eef80269cfc6e5eaf80a6de2eeeee022aa00e20b63b84309fe6a45a030f25dfb postfix-cdb-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: eef80269cfc6e5eaf80a6de2eeeee022aa00e20b63b84309fe6a45a030f25dfb postfix-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: ded830a22ff872ba8931fb4aa544d3e08afc7be92d218dd91fed5a2b87c9b1ad postfix-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: ded830a22ff872ba8931fb4aa544d3e08afc7be92d218dd91fed5a2b87c9b1ad postfix-debugsource-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 04a904c072f99302f44a367455cf8585a98850e4aa6c734e6018fb84d25ba1a5 postfix-debugsource-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 04a904c072f99302f44a367455cf8585a98850e4aa6c734e6018fb84d25ba1a5 postfix-ldap-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 7b6017472c1bd46167c7ae12f7504d2e6ce9d8155f0db8d7d39931dac0ee22b7 postfix-ldap-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 4d35ddadcef360aac22a774824ce20b3cf0d052f92f06bbda222927d74700943 postfix-ldap-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 4d35ddadcef360aac22a774824ce20b3cf0d052f92f06bbda222927d74700943 postfix-lmdb-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: e56c5b496a47e579d941b8c28cd386fca2045bcaaa8f0ad22d1ad81fdb589391 postfix-lmdb-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: e56c5b496a47e579d941b8c28cd386fca2045bcaaa8f0ad22d1ad81fdb589391 postfix-mysql-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: c8c8c987332f7b56630658bf9bfca09fcc30fd659a16a218f00ca602204f145c postfix-mysql-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 525eab76891e10bf54f5533c63b272df5664685029f02584dfae48f5cdd8dee2 postfix-mysql-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 525eab76891e10bf54f5533c63b272df5664685029f02584dfae48f5cdd8dee2 postfix-pcre-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: 6d1c23153cead11292e620ac6a9124ec349b4b17b4fae735d2ab2a0aaba8cf5d postfix-pcre-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: bdb8f60a29f3e2af8e67f3ae4a27bd2f8c9352f579e25ab8536823ce5eff745b postfix-pcre-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: bdb8f60a29f3e2af8e67f3ae4a27bd2f8c9352f579e25ab8536823ce5eff745b postfix-perl-scripts-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: eab46e3feeb8d818eb7cd20fbcd2c72a993c62521904edfc9aed6eef41d9bd47 postfix-pgsql-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: c1b4e15ef2ea0154f84c3e96e08214753bfa0d142239d68d62342a02d8bf9e6a postfix-pgsql-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: ed24fe07d2e25c71fe0df23cbba745c107a4bd93a831537e3eda1709dc84ac22 postfix-pgsql-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: ed24fe07d2e25c71fe0df23cbba745c107a4bd93a831537e3eda1709dc84ac22 postfix-sqlite-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: dc96d5c5c2212df3ce6f7b003b10a1ee79e334a0a7e1ef11e75160c0a52547b0 postfix-sqlite-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: bbaf988ff4877eb1ba1187253b012ed8b6da7ff9f0fabba1d23d22b9e638c659 postfix-sqlite-debuginfo-3.5.8-4.el8_6.1.x86_64.rpm SHA-256: bbaf988ff4877eb1ba1187253b012ed8b6da7ff9f0fabba1d23d22b9e638c659 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .