PatchTheCVEmutt vulnerabilities and fixes
Recent CVEs affecting mutt, with upgrade or downgrade steps. 3 tracked.
mutt has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2024-11-12. Highest priority: CVE-2024-49393 (score 39/100).
- CVE-2024-49395 MEDIUM 5.3 MITIGATE MITIGATE In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email head
- CVE-2024-49394 MEDIUM 5.3 MITIGATE MITIGATE In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows
- CVE-2024-49393 MEDIUM 6.5 MITIGATE MITIGATE In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an at
FAQ
How do I fix mutt vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mutt being exploited right now?
None of the tracked mutt CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mutt CVE should I patch first?
CVE-2024-49393 currently ranks highest (39/100): In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an at.