Security

.github/SECURITY.md

Security Policy

Supported Versions

Two latest incompatible releases (e.g. 2.0.0 and 1.9.0).

Latest release gets all bug fixes, features, etc. Previous incompatible release gets security fixes and fixes for problems that render software completely unusable in certain configurations with no workaround.

Reporting a Vulnerability

If you believe the vulnerabilitiy does have a big impact on existing deployments - email fox.cpp at disroot.org, put "[maddy security]" in the Subject.

Otherwise, open a public issue.

LDAP Filter Injection via Unsanitized Username
GHSA-5835-4gvc-32pc published Apr 12, 2026 by foxcpp

High
Full authentication bypass if SASL authorization username is specified
GHSA-4g76-w3xw-2x6w published Mar 13, 2023 by foxcpp

Critical
auth.pam allows accounts with expired passwords and expired accounts
GHSA-6cp7-g972-w9m9 published Mar 6, 2022 by foxcpp

Moderate
MD5 support in auth.shadow
GHSA-qh54-9vc5-m9fg published Oct 11, 2021 by foxcpp

Low
S3 storage write is not aborted on errors leading to unbounded memory usage
GHSA-m6m5-pp4g-fcc8 published Oct 6, 2021 by foxcpp

High
Denial-of-Service via specially crafted message (OOM crash)
GHSA-8jp9-qm2r-p877 published May 14, 2020 by foxcpp

Low

Learn more about advisories related to foxcpp/maddy in the GitHub Advisory Database

Overview · foxcpp/maddy · GitHub

Security: foxcpp/maddy

Security

.github/SECURITY.md

Security Policy

Supported Versions

Reporting a Vulnerability