Hi

See https://www.postfix.org/smtp-smuggling.html and CVE-2023-51764

A recent SMTP security issue that has been fixed in all supported Postfix versions.

However versions 3.5.8 and 3.5.9 shipped with RHEL 8 and 9 don't have the optional new "smtpd_forbid_unauth_pipelining" and "smtpd_forbid_bare_newline_exclusions" features yet.

(and the alternative "smtpd_data_restrictions = reject_unauth_pipelining" is not 100% equivalent).

Unless you're planning to rebase Postfix (to at least version 3.5.23), could you consider backporting these two new features?  They are disabled by default in Postfix versions < 3.9, so no change in behaviour unless explicitly configured.

Thanks