High
Security advisory
report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-36386
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 04:51 UTC · Revision 1
Source evidence
report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.
osv:CVE-2021-36386
Complete source record
{
"id": "8618f0d76dada0642c6023ca195c49a408f33de757afd9dd0e962bb8435fe388",
"url": "https://osv.dev/vulnerability/CVE-2021-36386",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-36386",
"summary": "report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.",
"evidence": "osv:CVE-2021-36386",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-36386",
"aliases": [
"CVE-2021-36386"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://gitlab.com/fetchmail/fetchmail",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "8a808068a3f351b1bdcfc85c5abdade073a27504"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:fetchmail:fetchmail:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "6.4.20"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"RELEASE_6-4-19",
"RELEASE_6-4-18",
"SNAPSHOT_6-4-18-rc1",
"RELEASE_6-4-17",
"RELEASE_6-4-16",
"SNAPSHOT_6-4-16-rc1",
"RELEASE_6-4-15",
"RELEASE_6-4-14",
"RELEASE_6-4-13",
"SNAPSHOT_6-4-13-rc2",
"SNAPSHOT_6-4-13-rc1",
"RELEASE_6-4-12",
"RELEASE_6-4-11",
"RELEASE_6-4-10",
"RELEASE_6-4-9",
"RELEASE_6-4-8",
"RELEASE_6-4-7",
"RELEASE_6-4-6",
"RELEASE_6-4-5",
"SNAPSHOT_6-4-5-rc2",
"SNAPSHOT_6-4-5-rc1",
"RELEASE_6-4-4",
"RELEASE_6-4-3",
"SNAPSHOT_6-4-3-rc2",
"SNAPSHOT_6-4-3-rc1",
"SNAPSHOT_6-4-3-beta1",
"RELEASE_6-4-2",
"SNAPSHOT-6_4_2_rc3",
"SNAPSHOT-6_4_2_rc2",
"SNAPSHOT-6_4_2_rc1",
"RELEASE_6-4-1",
"RELEASE_6-4-0",
"SNAPSHOT-6_4_0_rc4",
"SNAPSHOT-6_4_0_rc3",
"SNAPSHOT-6_4_0_rc2",
"SNAPSHOT-6_4_0_rc1",
"SNAPSHOT-6_4_0_beta5",
"SNAPSHOT-6_4_0_beta4",
"SNAPSHOT-6_4_0_beta3",
"SNAPSHOT-6_4_0_beta2",
"RELEASE_6-3-26",
"RELEASE_6-3-25",
"RELEASE_6-3-24",
"RELEASE_6-3-23",
"RELEASE_6-3-22",
"RELEASE_6-3-21",
"RELEASE_6-3-20",
"SNAPSHOT_6-3-20-rc3",
"SNAPSHOT_6-3-20-rc2",
"SNAPSHOT_6-3-20-pre1",
"RELEASE_6-3-19",
"SNAPSHOT_6-3-19-pre1",
"RELEASE_6-3-18",
"SNAPSHOT_6-3-18-pre2",
"SNAPSHOT_6-3-18-pre1",
"RELEASE_6-3-17",
"SNAPSHOT_6-3-17-pre1",
"RELEASE_6-3-16",
"RELEASE_6-3-15",
"SNAPSHOT_6-3-15-beta3",
"SNAPSHOT_6-3-15-beta2",
"SNAPSHOT_6-3-15-beta1",
"RELEASE_6-3-8",
"BRANCH_6-3",
"RELEASE_6-3-14",
"RELEASE_6-3-13",
"RELEASE_6-3-12",
"RELEASE_6-3-11",
"RELEASE_6-3-10",
"SNAPSHOT_6-3-10-beta1",
"RELEASE_6-3-9",
"RELEASE_6-3-9_5248",
"SNAPSHOT_6-3-9-rc3",
"SNAPSHOT_6-3-9-rc2",
"SNAPSHOT_6-3-9-rc1",
"RELEASE_6-3-8_5093",
"SNAPSHOT_6-3-8-rc3",
"SNAPSHOT_6-3-8-rc2",
"SNAPSHOT_6-3-8-rc1",
"RELEASE_6-3-7",
"SNAPSHOT_6-3-7-rc1",
"RELEASE_6-3-6",
"SNAPSHOT_6-3-6-rc5",
"SNAPSHOT_6-3-6-rc4",
"SNAPSHOT_6-3-6-rc3",
"SNAPSHOT_6-3-6-rc2",
"SNAPSHOT_6-3-6-rc1",
"RELEASE_6-3-5",
"SNAPSHOT_6-3-5-beta3",
"SNAPSHOT_6-3-5-beta2",
"SNAPSHOT_6-3-5-beta1",
"RELEASE_6-3-4",
"SNAPSHOT_6-3-4-rc2",
"SNAPSHOT_6-3-4-rc1",
"RELEASE_6-3-3",
"SNAPSHOT_6-3-3-rc2",
"SNAPSHOT_6-3-3-rc1",
"RELEASE_6-3-2",
"RELEASE_6-3-2_4678",
"SNAPSHOT_6-3-2-rc4",
"SNAPSHOT_6-3-2-rc3",
"SNAPSHOT_6-3-2-rc2",
"SNAPSHOT_6-3-2-rc1",
"RELEASE_6-3-1",
"SNAPSHOT_6-3-1-rc1",
"RELEASE_6-3-0",
"SNAPSHOT-6_2_9-rc10",
"SNAPSHOT-6_2_9-rc9",
"RELEASE_6-2-5",
"SNAPSHOT-6_2_9-rc8",
"SNAPSHOT-6_2_9-rc7",
"SNAPSHOT-6_2_9-rc6",
"SNAPSHOT-6_2_9-rc5",
"SNAPSHOT-6_2_9-rc4",
"SNAPSHOT-6_2_9-rc3",
"SNAPSHOT-6_2_9-rc2",
"SNAPSHOT-6_2_9-rc1",
"SNAPSHOT-6_2_6-pre9",
"SNAPSHOT-6_2_6-pre8",
"SNAPSHOT-6_2_6-pre7",
"SNAPSHOT-6_2_6-pre6",
"SNAPSHOT-6_2_6-pre5",
"SNAPSHOT_6-2-6-pre4",
"SNAPSHOT_6-2-6-pre3",
"before-automake",
"RELEASE_6-2-4",
"RELEASE_6-2-3",
"RELEASE_6-2-2",
"RELEASE_6-2-1",
"RELEASE_6-2-0",
"RELEASE_6-1-3",
"RELEASE_6-1-2",
"RELEASE_6-1-1",
"RELEASE_6-1-0",
"RELEASE_6-0-0",
"RELEASE_5-9-14",
"RELEASE_5-9-13",
"RELEASE_5-9-12",
"RELEASE_5-9-11",
"RELEASE_5-9-10",
"RELEASE_5-9-9",
"RELEASE_5-9-7",
"RELEASE_5-9-6",
"RELEASE_5-9-5",
"RELEASE_5-9-3",
"RELEASE_5-9-2",
"RELEASE_5-9-1",
"RELEASE_5-9-0",
"RELEASE_5-8-17",
"RELEASE_5-8-16",
"RELEASE_5-8-15",
"RELEASE_5-8-12",
"RELEASE_5-8-11",
"RELEASE_5-8-10",
"RELEASE_5-8-8",
"RELEASE_5-8-7",
"RELEASE_5-8-5",
"RELEASE_5-8-4",
"RELEASE_5-8-3",
"RELEASE_5-7-7",
"RELEASE_5-7-6",
"RELEASE_5-7-5",
"RELEASE_5-7-4",
"RELEASE_5-7-3",
"RELEASE_5-7-2",
"RELEASE_5-7-1",
"RELEASE_5-7-0",
"RELEASE_5-6-8",
"RELEASE_5-6-7",
"RELEASE_5-6-6",
"RELEASE_5-6-5",
"RELEASE_5-6-4",
"RELEASE_5-6-2",
"RELEASE_5-6-1",
"RELEASE_5-6-0",
"RELEASE_5-5-6",
"RELEASE_5-5-5",
"RELEASE_5-5-4",
"RELEASE_5-5-3",
"RELEASE_5-5-2",
"RELEASE_5-5-1",
"RELEASE_5-5-0",
"RELEASE_5-4-5",
"RELEASE_5-4-4",
"RELEASE_5-4-3",
"RELEASE_5-4-1",
"RELEASE_5-4-0",
"RELEASE_5-3-8",
"RELEASE_5-3-7",
"RELEASE_5-3-6",
"RELEASE_5-3-5",
"RELEASE_5-3-4",
"RELEASE_5-3-3",
"RELEASE_5-3-1",
"RELEASE_5-3-0",
"RELEASE_5-2-8",
"RELEASE_5-2-7",
"RELEASE_5-2-6",
"RELEASE_5-2-5",
"RELEASE_5-2-4",
"RELEASE_5-2-3",
"RELEASE_5-1-4",
"RELEASE_5-1-3",
"RELEASE_5-1-2",
"RELEASE_5-1-1",
"RELEASE_5-0-8",
"RELEASE_5-0-7",
"RELEASE_5-0-6",
"RELEASE_5-0-5",
"RELEASE_5-0-4",
"RELEASE_5-0-3",
"RELEASE_5-0-2",
"RELEASE_5-0-0",
"RELEASE_4-7-9",
"RELEASE_4-7-8",
"RELEASE_4-7-7",
"RELEASE_4-7-6",
"RELEASE_4-7-5",
"RELEASE_4-7-4",
"RELEASE_4-7-3",
"RELEASE_4-7-2",
"RELEASE_4-7-1",
"RELEASE_4-7-0",
"RELEASE_4-6-9",
"RELEASE_4-6-8",
"RELEASE_4-6-7",
"RELEASE_4-6-6",
"RELEASE_4-6-5",
"RELEASE_4-6-4",
"RELEASE_4-6-3",
"RELEASE_4-6-2",
"RELEASE_4-6-1",
"RELEASE_4-6-0",
"RELEASE_4-5-8",
"RELEASE_4-5-7",
"RELEASE_4-5-6",
"RELEASE_4-5-5",
"RELEASE_4-5-4",
"RELEASE_4-5-3",
"RELEASE_4-5-2",
"RELEASE_4-5-1",
"RELEASE_4-5-0bis",
"RELEASE_4-5-0",
"RELEASE_4-4-9",
"RELEASE_4-4-8",
"RELEASE_4-4-7",
"RELEASE_4-4-6bis",
"RELEASE_4-4-6",
"RELEASE_4-4-5bis",
"RELEASE_4-4-5",
"RELEASE_4-4-4",
"RELEASE_4-4-3",
"RELEASE_4-4-2",
"RELEASE_4-4-0",
"RELEASE_4-3-9",
"RELEASE_4-3-8bis",
"RELEASE_4-3-8",
"RELEASE_4-3-7",
"RELEASE_4-3-6",
"RELEASE_4-3-5",
"RELEASE_4-3-4",
"RELEASE_4-3-3",
"RELEASE_4-3-2",
"RELEASE_4-3-1",
"RELEASE_4-3-0",
"RELEASE_4-2-9",
"RELEASE_4-2-7",
"RELEASE_4-2-6",
"RELEASE_4-2-5",
"RELEASE_4-2-4",
"RELEASE_4-2-3",
"RELEASE_4-2-1",
"RELEASE_4-2-0",
"RELEASE_4-1-8",
"RELEASE_4-1-7",
"RELEASE_4-1-6",
"RELEASE_4-1-5",
"RELEASE_4-1-2",
"RELEASE_4-1-1",
"RELEASE_4-1-0",
"RELEASE_4-0-8",
"RELEASE_4-0-5",
"RELEASE_4-0-4",
"RELEASE_4-0-3",
"RELEASE_4-0-1",
"RELEASE_4-0-0bis",
"RELEASE_4-0-0",
"RELEASE_3-9-8",
"RELEASE_3-9-7",
"RELEASE_3-9-6",
"RELEASE_3-9-5",
"RELEASE_3-9-4",
"RELEASE_3-9-3",
"RELEASE_3-9-2",
"RELEASE_3-9-1",
"RELEASE_3-9-0",
"RELEASE_3-8-0",
"RELEASE_3-7-0",
"RELEASE_3-6-0",
"RELEASE_3-5-0",
"RELEASE_3-4-0",
"RELEASE_3-3-1",
"RELEASE_3-3-0",
"RELEASE_3-0-0",
"RELEASE_2-8tris",
"RELEASE_2-8bis",
"RELEASE_2-8-0",
"RELEASE_2-7-0",
"RELEASE_2-6-0",
"RELEASE_2-4-0bis",
"RELEASE_2-4-0",
"RELEASE_2-3-0",
"RELEASE_2-2-0",
"RELEASE_2-1-3",
"RELEASE_2-1-2",
"RELEASE_2-1-1",
"RELEASE_2-1-0",
"RELEASE_2-0-0",
"RELEASE_1-9-9",
"RELEASE_1-9-8",
"RELEASE_1-9-6",
"RELEASE_1-9-5",
"RELEASE_1-9-4",
"RELEASE_1-9-3",
"RELEASE_1-9-2",
"RELEASE_1-9-0",
"RELEASE_1-9a",
"RELEASE_1-8-0",
"RELEASE_1-0-0",
"p302a"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-36386.json"
}
}
],
"modified": "2026-11-01T02:30:54.399512547Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGYO5AHSXTCKA4NQC2Z4H3XMMYNAGC77/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIXKO6QW3AUHGJVWKJXBCOVBYJUJRBFC/",
"https://security.gentoo.org/glsa/202209-14",
"https://www.fetchmail.info/fetchmail-SA-2021-01.txt",
"https://www.fetchmail.info/security.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "33"
},
{
"last_affected": "33"
},
{
"introduced": "34"
},
{
"last_affected": "34"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-36386",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 430773,
"published_at": "2021-07-30T14:15:18.14+00:00"
}