Nixpkgs security tracker

Untriaged

Permalink CVE-2026-35389

created 1 month ago Activity log

Created suggestion 1 month ago

Bulwark Webmail S/MIME signature verification accepted self-signed certificates

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, S/MIME signature verification did not validate the certificate trust chain (checkChain: false). Any email signed with a self-signed or untrusted certificate was displayed as having a valid signature. This vulnerability is fixed in 1.4.11.

References

https://github.com/bulwarkmail/webmail/security/advisories/GHSA-v6w6-338p-p256 x_refsource_CONFIRM

Affected products

webmail

==< 1.4.11

Matching in nixpkgs

pkgs.ayatana-webmail

Webmail notifications and actions for any desktop

nixos-unstable 24.5.17
- nixpkgs-unstable 24.5.17
- nixos-unstable-small 24.5.17
nixos-25.11 24.5.17
- nixos-25.11-small 24.5.17
- nixpkgs-25.11-darwin 24.5.17

Package maintainers

@doronbehar Doron Behar <me@doronbehar.com>

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.ayatana-webmail

Package maintainers