CVE-2023-51765 sendmail allowed SMTP smuggling in certain configurations.
Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism.
This occurs because sendmail supports <LF>.<CR><LF> but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.
hard-coded "10" is not enough to listen on both IPv4 and IPv6 with a minimal configuration of MTA, MSA, and MSASSL on both localhost and primary interface (12 daemons). Raise limit to 64.