Postfix 3.11.6 lands, patching three decades of accumulated bugs

The latest stable update also covers six legacy branches, addressing remote DoS vectors and policy bypass flaws uncovered with the help of AI security researchers.

Postfix maintainer Wietse Venema has shipped Postfix 3.11.6, the newest stable release for the mail transfer agent that quietly powers more internet email than almost anything else. The update hits six legacy branches as well: 3.10.13, 3.9.14, 3.8.20, 3.7.22, 3.6.20, and 3.5.27. Venema describes the fixes as addressing medium-impact problems, though the announcement makes clear that some of them enable remote denial of service or policy bypass.

What actually caught my eye isn't just the patch count. It's how old the defects are. According to the release notes, more than half of the discovered issues predate Venema's own original design target. Several reach all the way back to the first alpha release in April 1997. They were found by Qualys, with assistance from Anthropic's Claude Mythos Preview, and by OpenAI Security. AI models hunting down decades-old C code bugs? The long wait for automated legacy auditing is finally paying off.

A codebase that refuses to die

Postfix now spans roughly 150,000 lines of C. Nearly three decades of continuous maintenance by a single primary developer. That kind of tenure accumulates state, and this release proves it.

Venema didn't shy away from the numbers.

"When I implemented Postfix, I knew that there were going to be mistakes," Venema wrote. "The number of defects may seem large, but considering that they were found in a code base of over 150 thousand lines, the error rate is still lower than what I designed for."

Keep in mind that the out-of-support branches (3.5 through 3.7) don't actually include patches for the earlier advisories covering large SMTP inputs, TLSA parsing, and SMTP smuggling from June 2026. If you're still running those older releases, you'll need to apply those prior patches separately alongside 3.5.27.

The policy bypass that's been waiting since 2004

The headline vulnerability is a missing SMTP server reset for MAIL FROM and RCPT TO state. Introduced in Postfix 2.2 back in November 2004, the flaw causes protocol state desynchronization between the client and the daemon. OpenAI Security found it.

Here's how it actually plays out in practice: an attacker sends a crafted RCPT TO followed by DATA without a preceding MAIL FROM, delivering a second message. Because the recipient counter exceeds one, the end-of-data restrictions skip check_recipient_access entirely. Access control policies go out the window.

There's also a Milter variant. If your mail filter accepted a message based on envelope inspection but Postfix rejected it at end-of-data, the Milter stayed locked in an "accept" state for the smuggled message. Completely bypassed. However, at the same time, Venema notes that the error rate remains well below his original architecture targets, which is arguably the only thing keeping server operators calm right now.

Beyond the policy bypass, the release addresses memory exhaustion via crafted BDAT requests (2018), address verification cache poisoning that could knock legitimate mail off the queue (2002), and a handful of memory safety violations ranging from read-after-free in postscreen_dnsbl.c to a buffer over-read in the DNS client that was actually introduced before the project's first public alpha.

Not cheap in terms of audit effort, considering the age of the code.

If you're running any branch from 3.5 through 3.11, you should update immediately. Prioritize the supported branches (3.10 and 3.11) first, then roll those earlier patches for the legacy releases. All fixes also landed in the unstable development build postfix-3.12-20260809 if you want to test ahead.

Head here to postfix.org for the full changelog and download mirrors.