CVE-2021-36386 - CVE House
Back to Database
Status published High CVE-2021-36386

report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization...

Vulnerability Description

report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-36386

Credits & Attribution

No credits recorded in the NVD database.

References

More from fetchmail

View All →
CVE-2025-61962
In fetchmail before 6.5.6, the SMTP client can crash when...
Medium 5.9
CVE-2021-39272
Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in...
Medium 5.9
CVE-2012-3482
Fetchmail 5.0.8 through 6.3.21, when using NTLM authentication in debug...
Medium 5.8
CVE-2011-1947
fetchmail 5.9.9 through 6.3.19 does not properly limit the wait...
Medium 5
CVE-2010-1167
fetchmail 4.6.3 through 6.3.16, when debug mode is enabled, does...
Medium 4.3

Affected Vendor

Affected Software

fetchmail, fedora
Vulnerable Versions:
0, 33, 34

Timeline

Official Publish: July 29th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.