2464859 – (CVE-2026-43860) CVE-2026-43860 mutt: mutt: Authentication bypass due to IMAP CRAM-MD5 hash truncation

Bug 2464859 (CVE-2026-43860) - CVE-2026-43860 mutt: mutt: Authentication bypass due to IMAP CRAM-MD5 hash truncation

Summary: CVE-2026-43860 mutt: mutt: Authentication bypass due to IMAP CRAM-MD5 hash tr...

Attachments	(Terms of Use)

Description OSIDB Bzimport 2026-05-04 07:01:35 UTC

mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest.

Note You need to log in before you can comment on or make changes to this bug.