postal

v3.3.7 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 14h Communication & Email

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

mail mail-server postal ruby smtp

Affected surfaces

rce_ssrf deps

ReleasePort's take

Moderate signal

editorial:auto 12h

ReleasePort Layer 1 version 3.3.7 adds security mitigations for SSRF and SQL‑injection attacks and upgrades core dependencies.

Why it matters: Prevents SSRF (severity 95) and SQL injection (severity 90) in outbound webhook requests and message‑database queries; upgrades rack and rails, improving stability.

Summary

AI summary

Updates Bug Fixes, Miscellaneous Chores, and 3.3.7 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Prevents SSRF in outbound webhook and HTTP endpoint requests Prevents SSRF in outbound webhook and HTTP endpoint requests Source: llm_adapter@2026-06-03 Confidence: high	—
Security	Critical	Prevents SQL injection via condition keys in message-db Prevents SQL injection via condition keys in message-db Source: llm_adapter@2026-06-03 Confidence: high	—
Dependency	Low	Upgrades rack and rails dependencies Upgrades rack and rails dependencies Source: llm_adapter@2026-06-03 Confidence: high	—

Full changelog

3.3.7 (2026-06-03)

Bug Fixes

http: prevent SSRF in outbound webhook and HTTP endpoint requests (11c9814)
message-db: prevent SQL injection via condition keys (GHSA-x2hq-rfpg-3xr5) (4314a6e)
specs: stub IPv6 support in address guard IPv6 literal spec (029bfe0)

Miscellaneous Chores

deps: upgrade rack & rails (0445e5c)
update security vulnerability reporting instructions (8be1e27)

Security Fixes

**GHSA-x2hq-rfpg-3xr5** – Prevent SQL injection via condition keys in message-db
Prevent SSRF in outbound webhook and HTTP endpoint requests (http module)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track postal

Get notified when new releases ship.

About postal

A fully featured open source mail delivery platform for incoming & outgoing e-mail

All releases →