Postfix 3.11.7 Drops: AI-Assisted Research Uncovers 27-Year-Old Mail Server Bugs
The latest security release patches SMTP smuggling, memory corruption, and legacy configuration holes that OpenAI and Qualys found with Claude.
Postfix has released version 3.11.7, rolling out medium-severity security fixes for SMTP smuggling, memory corruption, and several configuration hardening gaps. More interesting than the patches themselves is how they got found. Two teams at Qualys and OpenAI Security used AI models to dig through over two decades of legacy C code. The result is a patch that tackles bugs dating back to January 1999.
Postfix still runs the backbone of corporate mail. It's not exactly flashy. You rarely see it on stage at conferences. But when it breaks, entire organizations lose the ability to talk to each other. That baseline stability is exactly what makes latent bugs in its codebase so dangerous.
A New Era for Vulnerability Hunting
This isn't the first time AI has helped audit software, but the scale here is notable. OpenAI Security independently reported multiple defects, while Qualys worked alongside Anthropic's Claude Mythos Preview to surface the rest. Three of the flagged issues predate modern memory safety standards. One stems from Postfix's initial beta release in January 1999. Another has been sitting in the codebase since March 2005. They survived Wietse Venema's decades of active maintenance and a community that audits the project religiously. The fact that an AI model trained on decades of open-source C code could spot them says something about both the age of the software and the utility of modern tooling.
The smuggling vulnerabilities are the most immediately exploitable. Both tie into smtpd_proxy_filter, which sits disabled by default. The first stems from how the filter handles stray carriage-return characters. Upstream SMTP servers strip line feeds but leave carriage returns alone. A client can push a crafted command across the proxy boundary and trick the backend into executing it. OpenAI Security caught it. The second smuggling flaw activates when the upstream server adds a Require-TLS-ESMTP: yes header. Edge-case handling around that header lets the same trick slip through. Wietse Venema patched both this week.
The memory safety issues are more obscure but no less routine for legacy infrastructure. A null pointer read in the SMTP server process triggers a crash under one specific configuration combo: smtputf8_enable = yes paired with strict_smtputf8 = yes. It's not the default, but anyone running it gets a remote denial-of-service window. Meanwhile, a read-after-free in the milter heap, a use-after-free in postqueue's error logging, and a stale macro evaluation in the SMTP client all point to the same underlying reality. C code written twenty years ago doesn't always free memory in the right order. OpenAI Security flagged the milter heap overread. Qualys, backed by Claude, caught the other two.
Oracle MySQL 8 introduced a silent regression for Postfix's database layer. The tls_verify_cert = yes flag stopped working entirely against modern Oracle MySQL servers. TLS certificate verification quietly defaulted to disabled. You could be sending authentication credentials and mail queue data over an unencrypted channel without knowing it. OpenAI Security found the bypass. Venema tightened enforcement in 3.11.7.
Hardening changes round out the release. TLS session tickets now carry the master.cf service name, so one virtual mail server can't reuse tickets issued to another with different access controls. The postmap and postalias commands now warn when they'd create root-owned database files outside root-owned directories. postdrop blocks null bytes and line breaks in queue file envelopes. The pipe delivery agent finally stops silently dropping arguments when $user expands to nothing. That last one has been broken since 1999.
What You Need to Do
If you're running Postfix 3.5 through 3.11, you should update as soon as possible. The risk is lowest for systems that don't use smtpd_proxy_filter, but the memory safety fixes still matter. Keep in mind that the out-of-support legacy branches (3.5 through 3.7) do not include patches for the June 2026 advisories covering large SMTP inputs and TLSA parsing. You'll need to apply those older fixes separately.
It's a meaty release for what is essentially a background service. The AI-assisted discoveries are impressive, though they shouldn't replace manual audits of actively maintained code. The patch itself is straightforward.
Head here to the official Postfix distribution archives for the full changelog and download mirrors. Check your master.cf for proxy filter configurations, and verify your MySQL TLS settings if you upgraded your database server recently. The long tail of legacy vulnerabilities has a way of catching operators off guard. This release gives you a chance to close the gap.
