Postfix 3.11.6 Update Patches Remote DoS and 30-Year-Old Vulnerabilities Across Legacy Branches
Postfix maintainer Wietse Venema has released Postfix 3.11.6, a stable update addressing medium-impact vulnerabilities including remote denial of service and SMTP policy bypass flaws across the current stable branch and six legacy versions. More than half of the patched defects date back twenty or more years, with several vulnerabilities traced directly to the project's initial alpha release in 1997. The security issues were uncovered by Qualys using Anthropic's Claude Mythos Preview and by OpenAI Security, highlighting a growing trend of AI-assisted auditing in mature C codebases. Administrators are strongly advised to update immediately, while those still running out-of-support branches must also manually apply prior patches for large SMTP inputs and TLSA parsing.
Postfix 3.11.6 Update Patches Remote DoS and 30-Year-Old Vulnerabilities Across Legacy Branches
Postfix maintainer Wietse Venema has released version 3.11.6, which addresses multiple medium-impact vulnerabilities, including remote denial of service and SMTP policy bypass flaws, affecting both the current stable branch and six legacy versions. Many of the patched vulnerabilities date back over twenty years, with some originating from the project's initial alpha release in 1997, and were identified with the help of AI-assisted auditing tools by Qualys and OpenAI Security. The update emphasizes the ongoing maintenance and complexity of the Postfix codebase, which consists of approximately 150,000 lines of C code, and highlights the importance of updating to mitigate the identified security risks. Administrators are advised to prioritize updates for supported branches and manually apply previous patches for those on older, out-of-support versions
