Critical
Security advisory
OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-8794
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:26 UTC · Revision 1
Source evidence
OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.
osv:CVE-2020-8794
Complete source record
{
"id": "5ecb1c342c72435ad16cdaaceb62f58b397590b2c44c2f9a5a04cbdec847a6a7",
"url": "https://osv.dev/vulnerability/CVE-2020-8794",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-8794",
"summary": "OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.",
"evidence": "osv:CVE-2020-8794",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2020-8794",
"aliases": [
"CVE-2020-8794"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/opensmtpd/opensmtpd",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "555d2121736acdd70453b24b94c8c2996d9ab5f9"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:opensmtpd:opensmtpd:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "6.6.4"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"6.6.3p1",
"6.6.2p1",
"6.6.1p1",
"opensmtpd-201801101420p1",
"l",
"opensmtpd-201702130941p1",
"opensmtpd-201609141253p1",
"opensmtpd-201606220754p1",
"opensmtpd-201606152203p1",
"opensmtpd-201606071034p1",
"opensmtpd-201606062303p1",
"opensmtpd-201606062256p1",
"opensmtpd-201605221711p1",
"opensmtpd-5.9.1p1",
"opensmtpd-201602131907p1",
"opensmtpd-201602131612p1",
"opensmtpd-201602120826p1",
"opensmtpd-201602031446p1",
"opensmtpd-201601051911p1",
"opensmtpd-201506112227p1",
"opensmtpd-201506020910p1",
"opensmtpd-201505241924p1",
"opensmtpd-201505121836p1",
"opensmtpd-201505091607p1",
"opensmtpd-201502012312p1",
"opensmtpd-201501060207p1",
"opensmtpd-201412241507p1",
"opensmtpd-5.4.2p1",
"opensmtpd-201411052125p1",
"opensmtpd-201411042328p1",
"opensmtpd-201410152136p1",
"opensmtpd-201410131657p1",
"opensmtpd-201410040019p1",
"opensmtpd-201410012105p1",
"opensmtpd-201406192306p1",
"opensmtpd-201406192219p1",
"opensmtpd-201406190036p1",
"opensmtpd-201406170940p1",
"opensmtpd-201406061833p1",
"opensmtpd-201405202105p1",
"opensmtpd-201405142325p1",
"opensmtpd-201405142229p1",
"opensmtpd-201405121707p1",
"opensmtpd-201405121644p1",
"opensmtpd-201405071644p1",
"opensmtpd-201404151432p1",
"opensmtpd-201401241552p1",
"opensmtpd-201401231518p1",
"opensmtpd-201401202159p1",
"opensmtpd-201401201614p1",
"opensmtpd-201401201010p1",
"opensmtpd-201401061555p1",
"opensmtpd-201312142054p1",
"opensmtpd-201312131550p1",
"opensmtpd-201312081717p1",
"opensmtpd-201312021558p1",
"opensmtpd-201312021552p1",
"opensmtpd-201311292259p1",
"opensmtpd-201311281211p1",
"opensmtpd-201311270853p1",
"opensmtpd-201311261029p1",
"opensmtpd-201311201707p1",
"opensmtpd-201311182347p1",
"opensmtpd-201311181634p1",
"opensmtpd-201311071830p1",
"opensmtpd-201310281424p1",
"opensmtpd-201310251946p1",
"opensmtpd-201310241356p1",
"opensmtpd-201310231634p1",
"opensmtpd-201310101759p1",
"opensmtpd-201310081839p1",
"opensmtpd-201309261726p1",
"opensmtpd-201309251624p1",
"opensmtpd-201309241818p1",
"opensmtpd-201309241712p1",
"opensmtpd-201309241457p1",
"opensmtpd-201309201537p1",
"opensmtpd-201309121931p1",
"opensmtpd-201309121848p1",
"opensmtpd-201309091202p1",
"opensmtpd-201307290744p1",
"opensmtpd-201307221453p1",
"opensmtpd-201307191119p1",
"opensmtpd-201307191003p1",
"opensmtpd-201307151923p1",
"opensmtpd-201307121003p1",
"opensmtpd-201307091512p1",
"opensmtpd-201306271531p1",
"opensmtpd-201306211627p1",
"opensmtpd-201306071637p1",
"opensmtpd-201305241932p1",
"opensmtpd-201305171950p1",
"opensmtpd-201305171925p1",
"opensmtpd-201304041639p1",
"opensmtpd-201303311750p1",
"opensmtpd-5.3p1",
"opensmtpd-201303221610p1",
"opensmtpd-201303211343p1",
"opensmtpd-201303201252p1",
"opensmtpd-201303011853p1",
"opensmtpd-5.0p1",
"opensmtpd-201302212015p1",
"opensmtpd-201302152354p1",
"opensmtpd-201302141353p1",
"opensmtpd-201302051638p1",
"opensmtpd-201301281310p1",
"opensmtpd-201301252211p1",
"opensmtpd-201301241740p1",
"opensmtpd-201301191220p1",
"opensmtpd-201301111154p1",
"opensmtpd-201301031733p1",
"opensmtpd-201212222206p1",
"opensmtpd-201212081318p1",
"opensmtpd-201212031111p1",
"opensmtpd-201211261224p1",
"opensmtpd-201211232348p1",
"opensmtpd-201211152324p1",
"opensmtpd-5.2.1p1",
"opensmtpd-20121113231010p1",
"opensmtpd-20121107175757p1",
"opensmtpd-20121106111009p1",
"opensmtpd-20121030111957p1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8794.json",
"vanir_signatures": [
{
"id": "CVE-2020-8794-7da4040d",
"digest": {
"length": 852,
"function_hash": "196875953881991152077236116624259068501"
},
"source": "https://github.com/opensmtpd/opensmtpd/commit/555d2121736acdd70453b24b94c8c2996d9ab5f9",
"target": {
"file": "smtpd/queue_fs.c",
"function": "queue_fs_envelope_create"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-8794-8fca902c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242575823212615086944252627364996250139",
"191066550062516158912985716223257094754",
"166787329513173112996708886338970170939",
"256753418468187729585530898156176574718",
"273979709428202467439049274088971250784"
]
},
"source": "https://github.com/opensmtpd/opensmtpd/commit/555d2121736acdd70453b24b94c8c2996d9ab5f9",
"target": {
"file": "smtpd/queue_fs.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:24:38Z"
}
}
],
"modified": "2026-10-24T14:24:38.885428124Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPH4QU4DNVHA7ACFXMYFCEP5PSXXPN4E/",
"https://www.debian.org/security/2020/dsa-4634",
"https://www.openbsd.org/security.html",
"https://usn.ubuntu.com/4294-1/",
"https://www.openwall.com/lists/oss-security/2020/02/24/5"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
},
{
"introduced": "19.10"
},
{
"last_affected": "19.10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "31"
},
{
"last_affected": "31"
},
{
"introduced": "32"
},
{
"last_affected": "32"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-8794",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443713,
"published_at": "2020-02-25T17:15:13.197+00:00"
}