Medium 5.3Published Dec 23, 2023

CVE-2023-51764Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in re…

Updated under an hour ago (Oct 27, 2026, 3:40 PM ET)

Does this affect you?

It affects postfix and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for postfix

Exploited in the last 30 days

Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.

CVSS: 5.3 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: mitre
NVD analysis: Modified
Record last updated: Oct 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

postfix postfix postfix:postfix	before 3.5.23; from 3.6.0 before 3.6.13; from 3.7.0 before 3.7.9; from 3.8.0 before 3.8.4	NVD
fedoraproject fedora fedoraproject:fedora	38; 39	NVD
redhat enterprise_linux redhat:enterprise_linux	8.0; 9.0	NVD

References

References

https://www.postfix.org/smtp-smuggling.html
https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
http://www.openwall.com/lists/oss-security/2023/12/24/1	mailing-list
http://www.openwall.com/lists/oss-security/2023/12/25/1	mailing-list
https://bugzilla.redhat.com/show_bug.cgi?id=2255563
https://access.redhat.com/security/cve/CVE-2023-51764
https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html
https://github.com/eeenvik1/CVE-2023-51764
https://github.com/duy-31/CVE-2023-51764
https://www.youtube.com/watch?v=V8KPV96g1To
1–10 of 17

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.