CVE-2009-3766: Mutt

Medium severity, CVSS 6.8. EPSS: 1.1% chance of exploitation in the next 30 days.

mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected products

• Mutt Mutt: from 1.5.16, before 1.5.19 (fixed in 1.5.19)

Published 2009-10-23. Last modified 2026-06-16.