CVE-2011-1947: fetchmail 5.9.9 through 6.3.19 does not properly limit the wait time after issuing a (1) STARTTLS or (2) ST...

Security readout for executives and security teams

A vulnerable fetchmail client can be made to hang when talking to a remote mail server during TLS negotiation. The business impact is availability: mail retrieval may stop until the process is restarted or updated. The source bundle does not show evidence of active exploitation. Exposure is likely limited to systems running affected fetchmail versions that connect to a malicious, compromised, or faulty remote mail server. Environments using fetchmail for automated mailbox retrieval from third-party servers should check version and package provenance. Treat this as a targeted availability risk, not a broad system compromise issue. Prioritize remediation where fetchmail supports business-critical mail ingestion or polls third-party servers. Legacy systems are the main concern because the CVE dates from 2011. Mitigation focus: Inventory fetchmail installations and identify versions 5.9.9 through 6.3.19.; Apply fixed fetchmail packages from the OS vendor or fetchmail advisory.; Prioritize hosts that poll external or less-trusted mail servers..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.