PT-2026-36773 · Mutt · Mutt

Evilrabbit · Published 2026-05-04 · Updated 2026-05-09 · CVE-2026-43860

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions mutt versions prior to 2.3.2

Description An issue exists where the hash passwd is occasionally truncated by one byte during IMAP auth cram MD5 digest processes.

Recommendations Update to version 2.3.2 or later.

Fix

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2026-43860

OESA-2026-2200

Affected Products

Mutt

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-43864 · Security Note
• https://ubuntu.com/security/CVE-2026-43860 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43860 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43859 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2200 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43860 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43863 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43860 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43862 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43861 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43860 · Vendor Advisory
• https://github.com/muttmua/mutt/commit/834c5a2ed0479e51e8662a31caed129f136f4805 · Note
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2200 · Note