CVE-2009-1490: Sendmail

Medium severity, CVSS 5.0. EPSS: 12.6% chance of exploitation in the next 30 days.

Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long X- header, as demonstrated by an X-Testing header.

Affected products

• Sendmail Sendmail: up to and including 8.13.1.2; version 2.6 only; version 2.6.1 only; version 2.6.2 only; version 3.0 only; version 3.0.1 only; …

Published 2009-05-05. Last modified 2026-06-16.