CVE-2009-3941: Martin Lambers mpop before 1.0.19, when OpenSSL is used, does not properly handle a '\0' character in a dom...

Security readout for executives and security teams

CVE-2009-3941 affects mpop versions before 1.0.19 when built with OpenSSL. It can let an attacker on the network impersonate SSL mail servers using a specially crafted certificate from a legitimate CA. This threatens confidentiality and integrity of mail retrieval sessions, but the provided sources do not report active exploitation. Exposure is limited to systems using mpop before 1.0.19 with OpenSSL for SSL/TLS connections. Risk is higher on untrusted networks or where attackers can intercept mail traffic. The source bundle does not identify affected operating systems, packages, or deployment prevalence. Treat as a targeted remediation item for legacy mail tooling. It is not reported as actively exploited, but it can undermine SSL trust and expose credentials or mail content if vulnerable clients remain in use. Mitigation focus: Upgrade mpop to version 1.0.19 or later where applicable.; Confirm whether deployed mpop builds use OpenSSL.; Review vendor or distribution guidance for backported fixes..

Prepared

Jun 28, 2026, 18:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.