Postfix
Mail · products/postfix.yaml · RSS
Latest 3.11.7 Sep 8, 2026
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 3.11 | 3.11.7 | Mar 6, 2026 | — · maintained |
| 3.10 | 3.10.14 | Feb 16, 2025 | — · maintained |
| 3.9 | 3.9.15 | Mar 6, 2024 | — · maintained |
| 3.8 | 3.8.21 | Apr 17, 2023 | — · maintained |
| 3.7 | 3.7.23 | Feb 6, 2022 | Mar 6, 2026 · ended |
| 3.6 | 3.6.21 | Apr 29, 2021 | Feb 16, 2025 · ended |
| 3.5 | 3.5.28 | Mar 15, 2020 | Mar 6, 2024 · ended |
| 3.4 | 3.4.29 | Feb 27, 2019 | Apr 17, 2023 · ended |
| 3.3 | 3.3.22 | Feb 22, 2018 | Feb 5, 2022 · ended |
| 3.2 | 3.2.22 | Feb 28, 2017 | Apr 29, 2021 · ended |
| 3.1 | 3.1.15 | Feb 24, 2016 | Mar 15, 2020 · ended |
| 3.0 | 3.0.15 | Feb 8, 2015 | Feb 27, 2019 · ended |
| 2.11 | 2.11.11 | Jan 15, 2014 | Feb 21, 2018 · ended |
| 2.10 | 2.10.10 | Feb 11, 2013 | Feb 28, 2017 · ended |
| 2.9 | 2.9.15 | Feb 1, 2012 | Feb 24, 2016 · ended |
| 2.8 | 2.8.20 | Jan 20, 2011 | Feb 8, 2015 · ended |
| 2.6 | 2.6.19 | May 12, 2009 | Feb 11, 2013 · ended |
| 2.5 | 2.5.17 | Jan 24, 2008 | Feb 6, 2012 · ended |
Recent releases
Security advisories
3.7 CVE-2026-43964 Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.
5.3 CVE-2023-51764 Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in…
5.3 CVE-2020-12063 A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the similarity of \xce\xbf to the 'o' charact…
7.8 CVE-2017-10140 Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and la…
6.5 CVE-2012-0811 Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt fu…
6.8 CVE-2011-1720 The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server h…
6.8 CVE-2011-0411 The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle…
6.9 CVE-2009-2939 The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, which might allow local users to conduct symlink…
6.9 CVE-2008-4977 postfix_groups.pl in Postfix 2.5.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/postfix_groups.stdout, (2) /tmp/postfix_groups.stderr, and (3) /tmp/postfix_g…
2.1 CVE-2008-3889 Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of "non-Postfix" commands, which allows l…
6.2 CVE-2008-2936 Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a…
1.9 CVE-2008-2937 Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mai…