CVE-2023-51765: Freebsd

Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days.

sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.

Affected products

• Freebsd Freebsd: before 11.0 (fixed in 11.0)
• Red Hat Enterprise Linux: version 8.0 only; version 9.0 only
• Sendmail Sendmail: before 8.18.0.2 (fixed in 8.18.0.2)

Published 2023-12-24. Last modified 2026-06-17.