[Fetchmail-announce] fetchmail 6.6.9 is available (fixes POP3+NTLM auth bug since 6.6.7, fixes CR LF for warning messages from daemon mode)

[Matthias A. <mat...@gm...>]

The 6.6.9 release of fetchmail is now available at the usual locations,
including <https://downloads.sourceforge.net/project/fetchmail/branch_6.6/>
and <https://gitlab.com/fetchmail/fetchmail/-/releases/6.6.9>.

Users and distributors using NTLM-enabled builds are strongly advised to
upgrade; so are users who use fetchmail in daemon mode and whose MTA
rejects messages with bare LF lines.

The source archive is available at:
<https://downloads.sourceforge.net/project/fetchmail/branch_6.6/fetchmail-6.6.9.tar.xz/download>

The detached GnuPG signature is available at:
<https://downloads.sourceforge.net/project/fetchmail/branch_6.6/fetchmail-6.6.9.tar.xz.asc/download>

The SHA256 hashes for the tarballs are:
SHA2-256(fetchmail-6.6.9.tar.xz)= 3dfc47192e76099b5614f2b2a42198cb41fa05d7ca9b5073e08c051e9be81435


Here are the release notes:
--------------------------------------------------------------------------------
fetchmail-6.6.9 (released 2026-10-03, 31262 LoC):

## BUGFIXES:
* When fetchmail was built with NTLM support, and a POP3 server send
  a malformed challenge to the authentication request,
  fetchmail would call strtok() on an uninitialized stack buffer and
  could in extreme cases read off the end of the buffer if it did not
  contain 0x00 or 0x20 bytes, and corrupt the first 0x20 character to 0x00.
  This will not allow remote code injection but can cause undefined
  behavior including crashes of fetchmail or corrupting one bit of memory.
  This is a regression introduced by commit 09f95921 that also became
  part of all fetchmail-6.6.7.rc1 and later release candidates and the
  6.6.7 and 6.6.8 releases. It is separate from CVE-2026-94184 and
  just happened to be introduced anew in the same releases that fixed
  the mentioned CVE.
  Reported by Jakub Kulik, Gitlab Issue #98.
* Fix missing CR when sending multi-line warning messages from
  daemon mode. Reported by Andrea Venturoli, Gitlab Issue #99.

-------------------------------------------------------------------------------