Threat database

CVE-2023-51764 is a vulnerability in Postfix versions up to 3.8.5 that allows SMTP smuggling due to default configurations accommodating older SMTP clients. This flaw enables remote attackers to inject email messages with spoofed MAIL FROM addresses, potentially bypassing SPF protections. The issue arises because Postfix supports a non-standard line ending sequence (<LF>.<CR><LF>) that some other mail servers do not. Partial mitigations exist via configuration options, but a complete fix requires package updates to versions including the smtpd_forbid_bare_newline option.