EUVD-2026-101755

Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...

CVE-2026-110872

The Nodemailer library (versions 3.0.0 before 10.0.10) contains a quadratic complexity denial of service vulnerability within the SMTP client reply parser, specifically affecting SMTPConnection._onData and isPartialResponse. A malicious SMTP server or an on-path attacker can trigger this by strea...

CVE-2026-15340

A flaw was found in lwIP. The Simple Mail Transfer Protocol SMTP client does not properly validate the size of inputs, leading to a buffer overflow. A malicious SMTP server could use this flaw to crash or possibly execute arbitrary code with the privileges of the SMTP client by sending an...

Linux Distros Unpatched Vulnerability : CVE-2026-15340

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow. CVE-2026-15340 Note that Nessus relies on the presence of the packag...

DEBIAN-CVE-2026-15340

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow...

CVE-2026-15340

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow...

CVE-2026-15340

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow...

CVE-2026-15340 Savannah lwIP SMTP client Classic Buffer Overflow

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow...

CVE-2026-15340 Savannah lwIP SMTP client Classic Buffer Overflow

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow...

EUVD-2026-95820

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow...

CVE-2026-15340

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow...

CVE-2026-15340

The Savannah lwIP SMTP client (specifically version v2.2.1 ) is vulnerable to a classic buffer overflow because it fails to perform adequate size checks on inputs. This vulnerability could allow an attacker to crash the affected device or achieve remote code execution . Impacted systems are often...

PT-2026-107421

Name of the Vulnerable Software and Affected Versions Savannah lwIP SMTP client version 2.2.1 Description A buffer overflow exists in the SMTP client, which can be exploited to achieve remote code execution on industrial control systems. This issue allows attackers to perform lateral movement...

Savannah lwIP SMTP client

ADVISORY SUMMARY Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability...

PT-2026-105221

Security vulnerability affects the airflow-3 package. aiosmtplib is an asynchronous SMTP client for use with asyncio...

CVE-2026-81034 Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No...

CVE-2026-81034 Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No...

CVE-2026-81034

Netmaker (through v1.6.0 ) unconditionally disables TLS certificate verification on its SMTP connection in pro/email/smtp.go , where the skip-verify field is set to true with no configuration path to override it. An attacker positioned between Netmaker and its mail relay can present a rogue certi...

CVE-2026-81034 Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client

Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS configuration whose skip-verify field is set to true unconditionally, directly beneath a comment stating that the setting should be false in production. No...

SUSE CVE-2026-55558

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...