CVE-2006-5974: Fetchmail

High severity, CVSS 7.8. EPSS: 4% chance of exploitation in the next 30 days.

fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL pointer dereference when calling the (1) ferror or (2) fflush functions.

Affected products

• Fetchmail Fetchmail: version 6.3.5 only; version 6.3.6 only

Published 2006-12-31. Last modified 2026-06-16.