CVE-2004-2417: Smtp.proxy

High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days.

Format string vulnerability in smtp.c for smtp.proxy 1.1.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the (1) client hostname or (2) message-id, which are injected into a syslog message.

Affected products

• Smtp.proxy Smtp.proxy: version 1.1.3 only

Published 2004-12-31. Last modified 2026-06-16.