CVE-2024-27938: postal Improper Encoding

Description

Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed. This, in conjunction with a cooperative outgoing SMTP service, would allow for an incoming e-mail to be received by Postal addressed from a server that a user has 'authorised' to send mail on their behalf but were not the genuine author of the e-mail. Postal is not affected for sending outgoing e-mails as email is re-encoded with `<CR><LF>` line endings when transmitted over SMTP. This issue has been addressed and users should upgrade to Postal v3.0.0 or higher. Once upgraded, Postal will only accept End of DATA sequences which are explicitly `<CR><LF>.<CR><LF>`. If a non-compliant sequence is detected it will be logged to the SMTP server log. There are no workarounds for this issue.

Is your site exposed to CVE-2024-27938?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness Type (CWE)

CWE-116 CWE-116

Affected Products

Vendor	Product	Versions
postalserver	postal	< 3.0.0

References

Advisories & Patches

https://github.com/postalserver/postal/commit/0140dc4 https://github.com/postalserver/postal/security/advisories/GHSA-j42r-6c99-hqf2 https://github.com/postalserver/postal/commit/0140dc4 https://github.com/postalserver/postal/security/advisories/GHSA-j42r-6c99-hqf2

Exploits

https://www.postfix.org/smtp-smuggling.html https://www.postfix.org/smtp-smuggling.html

Other References

https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide

Frequently Asked Questions

What is CVE-2024-27938? +

Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may allow incoming e-mails to be spoofed. This, in conjunction with a cooperative outgoing SMTP service, would allow for an incoming e-mail to be received by Postal addressed from a server that a user has 'authorised' to send mail on their behalf but were not the genuine author of the e-mail. Postal is not affected for sending outgoing e-mails as email is re-encoded with `<CR><LF>` line endings when transmitted over SMTP. This issue has been addressed and users should upgrade to Postal v3.0.0 or higher. Once upgraded, Postal will only accept End of DATA sequences which are explicitly `<CR><LF>.<CR><LF>`. If a non-compliant sequence is detected it will be logged to the SMTP server log. There are no workarounds for this issue. It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2024-27938? +

CVE-2024-27938 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-27938? +

CVE-2024-27938 affects products from postalserver, specifically: postal. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-27938? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-53693

A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several client-side rendering paths interpolated tag names, collection …

CVE-2026-59727

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive …

CVE-2025-1308

A vulnerability exists in PX Backup whereby sensitive information may be logged under specific conditions.

CVE-2026-55730

Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to …

CVE-2026-42321

GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a …

CVE-2026-12496

Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and …

CVE-2024-27938