Medium
Security advisory
PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated email addresses. NOTE: the PostSRSd maintainer acknowledges "theoretically, this error should never occur ... I'm not sure if there's a reliable way to trigger this condition by an external attacker, but it is a security bug in PostSRSd nevertheless."
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-35525
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:45 UTC · Revision 1
Source evidence
PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated email addresses. NOTE: the PostSRSd maintainer acknowledges "theoretically, this error should never occur ... I'm not sure if there's a reliable way to trigger this condition by an external attacker, but it is a security bug in PostSRSd nevertheless."
osv:CVE-2021-35525
Complete source record
{
"id": "67e2059fb9dbfc273908d53f5c4d2bc768fc8e901e9a7ac3f7370ef403fbdb50",
"url": "https://osv.dev/vulnerability/CVE-2021-35525",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-35525",
"summary": "PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated email addresses. NOTE: the PostSRSd maintainer acknowledges \"theoretically, this error should never occur ... I'm not sure if there's a reliable way to trigger this condition by an external attacker, but it is a security bug in PostSRSd nevertheless.\"",
"evidence": "osv:CVE-2021-35525",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-35525",
"aliases": [
"CVE-2021-35525"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/roehling/postsrsd",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "67cd6eae8eb0e6dcb4127baff588af07759643ce"
},
{
"fixed": "077be98d8c8a9847e4ae0c7dc09e7474cbe27db2"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:postsrsd_project:postsrsd:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.11"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "077be98d8c8a9847e4ae0c7dc09e7474cbe27db2"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "67cd6eae8eb0e6dcb4127baff588af07759643ce"
}
],
"source": "REFERENCES_TAG",
"original_tag": "1.11"
}
]
}
}
],
"versions": [
"1.10",
"1.9",
"1.8",
"1.7",
"1.6",
"1.5",
"1.4",
"1.3",
"1.2",
"1.1",
"1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-35525.json",
"vanir_signatures": [
{
"id": "CVE-2021-35525-7a462af7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114569383962023219559100666745867562505",
"219503413355299878239505911635227857634",
"212696949781320512734217356151229946819",
"2670085903009784751101381710898196003",
"5649181508076085041746994120856640496",
"72365786694670864541593521962678602073",
"332053156429864495665554635764587086136",
"335411550119694145242976179301858929527",
"249982308931409208471461181625366571643",
"211591182885679203261428264752833138519",
"186779625746040801697711048258590035822",
"58102085347133306172592416676635128075",
"48382476309005207726184023101877677156",
"174004379907665534584885805064968521638",
"286163441142007654043373165644791020525",
"141412925990212278321444530926539231949",
"183757437535633113213291860347266403052",
"315556289331415417162079350519662090933",
"233493307986003114337809140353844631054",
"262158665803866507521764661982945869203",
"324148460677818757671075646342155855384",
"232121774091589642936304613102002015566",
"240007579326281670771227311769092659313",
"71920091971025669657444931200052501746",
"247892337485324190572739863401697719725",
"85710148368912828244976399951211664855",
"120504828612821731785187913728945457255",
"311777769607868852566443104416529350786",
"232121774091589642936304613102002015566",
"240007579326281670771227311769092659313",
"299723424414018003847413259895933290894",
"46654873682075936317606261479621294916",
"15038841786247973457778655237712338956",
"337771425144432590340199650720672487943",
"91679675537453942143943646597082712203",
"232121774091589642936304613102002015566",
"240007579326281670771227311769092659313",
"73938147732098566579455819955128188438",
"336131130495870536360217840557316223209",
"173369963563305225486767560344380161513",
"156964338338991817151131222284240497503",
"130922620574880320661270985796956350981",
"115804511836399847261547328480301228579",
"232661323117712013833390988457301033446",
"102849474277674589927284518033393733684",
"66321221316955709175540157669624165588",
"86278926276355144418361472469572074461"
]
},
"source": "https://github.com/roehling/postsrsd/commit/077be98d8c8a9847e4ae0c7dc09e7474cbe27db2",
"target": {
"file": "postsrsd.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-35525-ea87965d",
"digest": {
"length": 8384,
"function_hash": "213462266672670075161301342346165526897"
},
"source": "https://github.com/roehling/postsrsd/commit/077be98d8c8a9847e4ae0c7dc09e7474cbe27db2",
"target": {
"file": "postsrsd.c",
"function": "main"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:25:22Z"
}
}
],
"modified": "2026-10-20T14:25:22.397095438Z",
"provider": "osv",
"references": [
"https://github.com/roehling/postsrsd/releases/tag/1.11",
"https://security.gentoo.org/glsa/202107-08",
"https://bugs.gentoo.org/793674",
"https://github.com/roehling/postsrsd/commit/077be98d8c8a9847e4ae0c7dc09e7474cbe27db2"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-35525",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388976,
"published_at": "2021-06-28T18:15:08.03+00:00"
}