CVE-2000-0075: Super Mail Transfer Package (SMTP), later called MsgCore, has a memory leak which allows remote attackers t...

Security readout for executives and security teams

An old email server product called Super Mail Transfer Package (later renamed MsgCore) has a memory leak that a remote attacker can trigger by repeatedly issuing common SMTP commands in one session. Over time this exhausts server memory and can cause a denial of service, disrupting email delivery. It does not expose data or grant access, but it can knock the mail service offline. Exposure is limited to environments still running Super Mail Transfer Package or MsgCore SMTP daemons reachable over a network. Given the product's obscurity and the CVE's 2000 publication date, active production exposure in modern enterprises is unlikely, though legacy or embedded mail relays could still be affected. Low priority for most organizations. The affected product is obscure and long unmaintained, and the flaw only causes service disruption rather than data loss. Prioritize only if inventory confirms the legacy SMTP software is still running on internet-facing or business-critical mail paths. Mitigation focus: Inventory mail infrastructure for any Super Mail Transfer Package or MsgCore deployments.; Retire or replace legacy MsgCore SMTP servers with a maintained mail platform.; Restrict inbound SMTP to trusted relays where the legacy service cannot be removed immediately..

Prepared

Jul 12, 2026, 01:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.