Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/foxcpp/maddy

4 known vulnerabilities (1 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
v0.9.7 (Nov 5, 2026): no advisory affects it
Newest unaffected release
v0.9.7 (Nov 5, 2026), the latest release
Advisories
4 · 1 critical, 1 high, 1 medium
Releases
35 since v0.1.0 (Feb 22, 2020)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

  • Maddy Mail Server: LDAP Filter Injection via Unsanitized Username

    Affected: fixed in 0.9.3.

    Fixed in v0.9.3 (released Apr 12, 2026, 3 days before disclosure).

    The latest release, v0.9.7, is not affected.

  • CVE-2023-27582Critical 9.1

    Full authentication bypass if SASL authorization username is specified

    Affected: from 0.2.0, fixed in 0.6.3.

    Fixed in v0.6.3 (released Mar 13, 2023, the day of disclosure).

    The latest release, v0.9.7, is not affected.

  • CVE-2022-24732Medium 6.3

    Maddy Mail Server does not implement account expiry

    Affected: fixed in 0.5.4.

    Fixed in v0.5.4 (released Mar 6, 2022, 3 days before disclosure).

    The latest release, v0.9.7, is not affected.

  • A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the…

    Affected: fixed in 0.5.2.

    Fixed in v0.5.2 (released Oct 11, 2021, 78 days before disclosure).

    The latest release, v0.9.7, is not affected.