CVE-2022-24732: Maddy Mail Server does not implement account expiry

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-09 · updated 2026-06-17
Weakness: CWE-324

Description

Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing filtering mechanisms.

Affected products

foxcpp maddy: from 0.5.0 before 0.5.4 — fixed in 0.5.4

How to fix

Upgrade to a fixed version: foxcpp maddy 0.5.4. Check the vendor advisory for mitigations.

References

https://github.com/foxcpp/maddy/commit/7ee6a39c6a1939b376545f030a5efd6f90913583
https://github.com/foxcpp/maddy/security/advisories/GHSA-6cp7-g972-w9m9
https://github.com/foxcpp/maddy/commit/7ee6a39c6a1939b376545f030a5efd6f90913583
https://github.com/foxcpp/maddy/security/advisories/GHSA-6cp7-g972-w9m9

Get alerted when CVE-2022-24732 or the next vulnerability affects your stack