Is CVE-2006-4434 being actively exploited?

CVE-2006-4434 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2006-4434?

CVE-2006-4434 has a CVSS 3.1 base score of 7.5 (HIGH).

CVE-2006-4434

HIGH · CVSS 7.5EPSS 4.5%EU EUVD

Use-after-free vulnerability in Sendmail before 8.13.8 allows remote attackers to cause a denial of service (crash) via a long "header line", which causes a previously freed variable to be referenced. NOTE: the original developer has disputed the severity of this issue, saying "The only denial of service that is possible here is to fill up the disk with core dumps if the OS actually generates different core dumps (which is unlikely)... the bug is in the shutdown code (finis()) which leads directly to exit(3), i.e., the process would terminate anyway, no mail delivery or receiption is affected."

Key facts

CVSS score: 7.5 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-416
EPSS score: 4.5% (92th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2006-4422)
Published: August 29, 2006
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2006-4422 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

sendmail / sendmail

References

http://secunia.com/advisories/21637(Broken Link, Patch, Vendor Advisory)
http://secunia.com/advisories/21641(Broken Link, Patch, Vendor Advisory)
http://secunia.com/advisories/21696(Broken Link, Vendor Advisory)
http://secunia.com/advisories/21700(Broken Link, Vendor Advisory)
http://secunia.com/advisories/21749(Broken Link, Vendor Advisory)
http://secunia.com/advisories/22369(Broken Link, Vendor Advisory)
http://securitytracker.com/id?1016753(Broken Link, Patch, Third Party Advisory, VDB Entry)
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102664-1(Broken Link)
http://www.attrition.org/pipermail/vim/2006-August/000999.html(Mailing List)
http://www.debian.org/security/2006/dsa-1164(Broken Link)
http://www.mandriva.com/security/advisories?name=MDKSA-2006:156(Broken Link)
http://www.novell.com/linux/security/advisories/2006_21_sr.html(Broken Link)
http://www.openbsd.org/errata.html#sendmail3(Release Notes)
http://www.openbsd.org/errata38.html#sendmail3(Third Party Advisory)
http://www.osvdb.org/28193(Broken Link)
http://www.securityfocus.com/bid/19714(Broken Link, Patch, Third Party Advisory, VDB Entry)
http://www.sendmail.org/releases/8.13.8.html(Release Notes)
http://www.vupen.com/english/advisories/2006/3393(Broken Link, Vendor Advisory)
http://www.vupen.com/english/advisories/2006/3994(Broken Link, Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain