CVE-2026-41113

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-41113

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41113.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-41113

Published

2026-04-16T22:02:10Z

Modified

2026-10-21T10:10:48Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remote.c.

Database specific

{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41113.json"
}

References

Affected packages

Git / github.com/sagredo-dev/qmail

Affected ranges

Type

GIT

Repo

https://github.com/sagredo-dev/qmail

Events

Introduced

e079d943b0d910ab49f07687cef906f9e28b87f9

Fixed

b5168117cdfc15eba30ee7d42d604122d6eaf4d4

Fixed

749f607f6885e3d01b36f2647d7a1db88f1ef741

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2024.10.26"
                },
                {
                    "fixed":  "2026.04.07"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "749f607f6885e3d01b36f2647d7a1db88f1ef741"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v2026.04.07",
            "range":  [
                {
                    "fixed":  "b5168117cdfc15eba30ee7d42d604122d6eaf4d4"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2024.*

v2024.10.26

v2024.11.10

v2024.11.27

v2024.12.01

v2025.*

v2025.02.11

v2025.04.18

v2025.04.25

v2025.04.30

v2025.06.09

v2025.07.10

v2025.09.08

v2026.*

v2026.01.05

v2026.01.08

v2026.02.03

v2026.02.25

v2026.04.02

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41113.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "250818064675521272194530780502460141876",
                "283259642195759802335219502319762387262",
                "305454327984811636036646215617871616514",
                "210891690278065800079327939715427433462",
                "23537543757640783442381498949754890557",
                "25129143881009412665796464448856390329",
                "118276686288924030506665355039553099793",
                "53554339082025429254904913139584862679",
                "129883263142917550974059578584727172192",
                "172332182901214255963344869398046526235",
                "312953681237936975713762936384244517451",
                "89076021685998851130907040681907465450",
                "20357230322449211620360459245871621265",
                "221117491516943793720628421302954567329",
                "275412760649637224491093825256098272451",
                "47045477384016925123866449769715345632",
                "161708686607796281722735114794234300977",
                "146577115785260609035194689179237189625",
                "291946056723998673954370783482487019415",
                "26719189049086865749675284234146493744"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-41113-c15d641c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/sagredo-dev/qmail/commit/749f607f6885e3d01b36f2647d7a1db88f1ef741",
        "target":  {
            "file":  "qmail-remote.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "8252706129479349729818429706725705159",
            "length":  573
        },
        "id":  "CVE-2026-41113-cf7734dc",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/sagredo-dev/qmail/commit/749f607f6885e3d01b36f2647d7a1db88f1ef741",
        "target":  {
            "file":  "qmail-remote.c",
            "function":  "tls_quit"
        }
    }
]

vanir_signatures_modified

"2026-10-21T10:10:48Z"