PatchTheCVECVE-2006-4434: Use-after-free vulnerability in Sendmail before 8.13.8 allows remote attackers to cause a denial of service (c
CVE-2006-4434 is a high-severity flaw (CVSS 7.5) affecting sendmail. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Use-after-free vulnerability in Sendmail before 8.13.8 allows remote attackers to cause a denial of service (crash) via a long "header line", which causes a previously freed variable to be referenced. NOTE: the original developer has disputed the severity of this issue, saying "The only denial of service that is possible here is to fill up the disk with core dumps if the OS actually generates different core dumps (which is unlikely)... the bug is
Why this priority
- High severity
- EPSS top 8%: very likely to be exploited
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 4.5% (top 8%) |
| CISA exploited list | No |
| Weakness | CWE-416 |
| Published | 2006-08-29 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2006-4434?
sendmail: upgrade to 8.13.8. Exact commands for each OS are on this page.
Is CVE-2006-4434 being exploited?
CVE-2006-4434 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2006-4434 affect?
CVE-2006-4434 affects sendmail. Severity is high (CVSS 7.5). Use-after-free vulnerability in Sendmail before 8.13.8 allows remote attackers to cause a denial of service (crash) via a long "header line", which causes a previously freed variable to be referenced. NOTE: the original developer has disput
How urgent is CVE-2006-4434?
Priority 54/100. High severity; EPSS top 8%: very likely to be exploited; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2023-51765 MEDIUM 5.3 UPGRADE UPGRADE sendmail through 8.17.2 allows SMTP smuggling in certain configurations
- CVE-2021-3618 HIGH 7.4 UPGRADE UPGRADE ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing differen
- CVE-2014-3956 LOW 1.9 UPGRADE UPGRADE The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and conseq
- CVE-2009-4565 HIGH 7.5 UPGRADE sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certi
- CVE-2009-1490 MEDIUM 5.0 UPGRADE Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (dae