CVE-2009-4565: Sendmail

High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days.

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Affected products

• Sendmail Sendmail: up to and including 8.14.3; version 2.6 only; version 2.6.1 only; version 3.0 only; version 3.0.1 only; version 4.1 only; …

Published 2010-01-04. Last modified 2026-06-16.