CVE-2023-52354 is a high severity (7.5) SMTP smuggling flaw in the chasquid mail server before version 1.13, caused by accepting LF terminated lines. The chasquid maintainers fixed it in 1.13 and backported the fix to 1.11.1, so upgrade to one of those.
What's affected
NVD lists chasquid before 1.13. The chasquid release notes record the fix under 1.13 (2023-12-24), and a backport under 1.11.1 (2023-12-26) for people who stay on the 1.11 line.
Weakness class: CWE-444.
The release notes describe a second change in the same version: the mail courier that sends outgoing messages now uses CRLF terminated lines, where earlier releases used LF terminated lines. That matters if you run a custom relay path that expected the old behavior.
How to check if you're exposed
Find the chasquid version you run. If it came from a container image, read the tag. Notes in the release page say that pulling the master label updates it, and that no action is needed if you use the latest tag.
For a distribution package, query the package manager, for example dpkg -l chasquid or apk info chasquid, and compare with 1.13 or 1.11.1.
After upgrading, send a test message from a client that uses normal CRLF line endings to confirm delivery is unchanged.
What to do now
- Upgrade chasquid to 1.13, or to 1.11.1 if you cannot move off the 1.11 line.
- Restart the service and check delivery and logs.
- Review any scripts or tools that submit mail to chasquid with bare LF line endings, because the server now aborts the connection when it sees an invalid line terminator.
- If you relay through other mail servers, check their SMTP smuggling advisories too, since the technique depends on both ends.
Why it matters
SMTP smuggling relies on two mail systems disagreeing about where a message ends. The standards say the only valid newline in SMTP is CRLF. Servers that also accept a bare LF can be tricked into treating part of a message body as a separate command or message.
The fix is strict: the release notes say that when an invalid newline terminator is found in an incoming message, the connection is now aborted immediately. I will not describe the byte sequences involved. The CVE is not in the CISA Known Exploited Vulnerabilities catalog per the record.
Quick check
Which chasquid versions fix it?
The release notes list 1.13 (2023-12-24) and the backport 1.11.1 (2023-12-26).
Will the fix break anything?
It may break clients that send bare LF line endings, because the server now closes the connection when it sees one.
Sources
Last reviewed: 19 October 2026.
