CVE-2021-36386: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days.

report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.

Affected products

• Fedoraproject Fedora: version 33 only; version 34 only
• Fetchmail Fetchmail: before 6.4.20 (fixed in 6.4.20)

Published 2021-07-30. Last modified 2026-06-17.