Every CVE Search/ Get API key

CVE-2021-3181

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox...

6.5 MediumFix available

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.83%Down 1.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.

Record
CVE-2021-3181
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-401
Updated
2026-11-02
CVE List No score

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.

Record
CVE-2021-3181
Updated
2026-11-02
EUVDEUVD-2021-26524 No score

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.

Record
EUVD-2021-26524
Updated
2026-11-03
GitHub AdvisoriesGHSA-prp6-7gc9-4jmw 6.5

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox...

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.

Record
GHSA-prp6-7gc9-4jmw
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVALPINE-CVE-2021-3181 6.5

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.

Record
ALPINE-CVE-2021-3181
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 6.5

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.

Record
CVE-2021-3181
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 13 moreShow less
OSVDEBIAN-CVE-2021-3181 6.5

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.

Record
DEBIAN-CVE-2021-3181
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2021-1079 6.5

mutt security update

Mutt is a small but very powerful text-based mail client for Unix operating systems.

Security Fix(es):

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.(CVE-2021-3181)

Record
OESA-2021-1079
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:4181 6.5

Red Hat Security Advisory: mutt security, bug fix, and enhancement update

Record
RHSA-2021:4181
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2021:4181 6.5

Moderate: mutt security, bug fix, and enhancement update

Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.

The following packages have been upgraded to a later upstream version: mutt (2.0.7). (BZ#1912614)

Security Fix(es):

  • mutt: Incorrect handling of invalid initial IMAP responses could lead to an authentication attempt over unencrypted connection (CVE-2020-28896)

  • mutt: Memory leak when parsing rfc822 group addresses (CVE-2021-3181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Record
RLSA-2021:4181
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-3181 6.5

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.

Record
UBUNTU-CVE-2021-3181
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2021:4181 No score

Moderate: mutt security, bug fix, and enhancement update

Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.

The following packages have been upgraded to a later upstream version: mutt (2.0.7). (BZ#1912614)

Security Fix(es):

  • mutt: Incorrect handling of invalid initial IMAP responses could lead to an authentication attempt over unencrypted connection (CVE-2020-28896)

  • mutt: Memory leak when parsing rfc822 group addresses (CVE-2021-3181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2021:4181
Updated
2026-11-02
OSVMGASA-2021-0070 No score

Updated mutt packages fix a security vulnerability

It was discovered that Mutt incorrectly handled certain email messages. An attacker could possibly use this issue to cause a denial of service because rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). (CVE-2021-3181).

mutt-1.11.4 has been patched for Mageia 7.

Record
MGASA-2021-0070
Updated
2026-11-02
OSVopenSUSE-SU-2021:0161-1 No score

Security update for mutt

This update for mutt fixes the following issue:

  • CVE-2021-3181: Fixed a memory leak in recipient parsing (bsc#1181221).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:0161-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0162-1 No score

Security update for mutt

This update for mutt fixes the following issue:

  • CVE-2021-3181: Fixed a memory leak in recipient parsing (bsc#1181221).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:0162-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11069-1 No score

mutt-2.0.7-2.2 on GA media

These are all security issues fixed in the mutt-2.0.7-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11069-1
Updated
2026-11-02
OSVSUSE-SU-2021:0195-1 No score

Security update for mutt

This update for mutt fixes the following issue:

  • CVE-2021-3181: Fixed a memory leak in recipient parsing (bsc#1181221).
Record
SUSE-SU-2021:0195-1
Updated
2026-11-02
OSVSUSE-SU-2021:0196-1 No score

Security update for mutt

This update for mutt fixes the following issue:

  • CVE-2021-3181: Fixed a memory leak in recipient parsing (bsc#1181221).
Record
SUSE-SU-2021:0196-1
Updated
2026-11-02
OSVUSN-4703-1 No score

mutt vulnerability

It was discovered that Mutt incorrectly handled certain email messages. An attacker could possibly use this issue to cause a denial of service.

Record
USN-4703-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mutt
Alpine:v3.12
 before 1.14.7-r0
1.14.7-r0
mutt
Alpine:v3.13
 before 2.0.4-r1
2.0.4-r1
mutt
Alpine:v3.14
 before 2.0.4-r1
2.0.4-r1
mutt
Alpine:v3.15
 before 2.0.4-r1
2.0.4-r1
mutt
Alpine:v3.16
 before 2.0.4-r1
2.0.4-r1
mutt
Alpine:v3.17
 before 2.0.4-r1
2.0.4-r1
mutt
Alpine:v3.18
 before 2.0.4-r1
2.0.4-r1
mutt
Alpine:v3.19
 before 2.0.4-r1
2.0.4-r1
mutt
Alpine:v3.20
 before 2.0.4-r1
2.0.4-r1
mutt
Alpine:v3.21
 before 2.0.4-r1
2.0.4-r1
Show 25 moreShow less
Affected packages
PackageAffectedFixed
mutt
Alpine:v3.22
 before 2.0.4-r1
2.0.4-r1
mutt
Alpine:v3.23
 before 2.0.4-r1
2.0.4-r1
mutt
Alpine:v3.24
 before 2.0.4-r1
2.0.4-r1
mutt
AlmaLinux:8
From an advisory covering 2 CVEs
 before 5:2.0.7-1.el8
5:2.0.7-1.el8
mutt
Debian:12
 before 2.0.5-1
2.0.5-1
mutt
Debian:13
 before 2.0.5-1
2.0.5-1
mutt
Debian:14
 before 2.0.5-1
2.0.5-1
mutt
Debian:9
 before 1.7.2-1+deb9u5, plus listed versions
1.7.2-11.7.2-1+deb9u11.7.2-1+deb9u21.7.2-1+deb9u31.7.2-1+deb9u4
1.7.2-1+deb9u5
mutt
Debian:10
 before 1.10.1-2.1+deb10u5, plus listed versions
1.10.1-2.11.10.1-2.1+deb10u11.10.1-2.1+deb10u21.10.1-2.1+deb10u31.10.1-2.1+deb10u4
1.10.1-2.1+deb10u5
mutt
Mageia:7
 before 1.11.4-1.5.mga7
1.11.4-1.5.mga7
mutt
openEuler:20.03-LTS
 before 1.10.1-5.oe1
1.10.1-5.oe1
mutt
openEuler:20.03-LTS-SP1
 before 1.10.1-5.oe1
1.10.1-5.oe1
mutt
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 5:2.0.7-1.el8
5:2.0.7-1.el8
mutt-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 5:2.0.7-1.el8
5:2.0.7-1.el8
mutt-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 5:2.0.7-1.el8
5:2.0.7-1.el8
mutt
Rocky Linux:8
From an advisory covering 2 CVEs
 before 5:2.0.7-1.el8
5:2.0.7-1.el8
mutt
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 1.10.1-3.20.1
1.10.1-3.20.1
mutt
SUSE:Linux Enterprise Server 12 SP5
 before 1.10.1-55.24.1
1.10.1-55.24.1
mutt
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.10.1-55.24.1
1.10.1-55.24.1
mutt
Ubuntu:16.04:LTS
 before 1.5.24-1ubuntu0.6, plus listed versions
1.5.23-3.1ubuntu11.5.23-3.1ubuntu21.5.24-11.5.24-1build11.5.24-1ubuntu0.1
Show 4 moreShow less
1.5.24-1ubuntu0.21.5.24-1ubuntu0.31.5.24-1ubuntu0.41.5.24-1ubuntu0.5
1.5.24-1ubuntu0.6
mutt
Ubuntu:18.04:LTS
 before 1.9.4-3ubuntu0.5, plus listed versions
1.8.3+neomutt20170609-2build11.9.1-21.9.1-31.9.1-41.9.1-5
Show 8 moreShow less
1.9.2-11.9.3-11.9.4-21.9.4-31.9.4-3ubuntu0.11.9.4-3ubuntu0.21.9.4-3ubuntu0.31.9.4-3ubuntu0.4
1.9.4-3ubuntu0.5
mutt
Ubuntu:20.04:LTS
 before 1.13.2-1ubuntu0.4, plus listed versions
1.10.1-2.11.12.2-11.12.2-21.13.0-11.13.2-11.13.2-1ubuntu0.11.13.2-1ubuntu0.21.13.2-1ubuntu0.3
1.13.2-1ubuntu0.4
mutt
openSUSE:Leap 15.1
 before 1.10.1-lp151.2.15.1
1.10.1-lp151.2.15.1
mutt
openSUSE:Leap 15.2
 before 1.10.1-lp152.3.15.1
1.10.1-lp152.3.15.1
mutt
openSUSE:Tumbleweed
From an advisory covering 21 CVEs
 before 2.0.7-2.2
2.0.7-2.2

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3181 is a medium vulnerability (CVSS 6.5) in Mutt, published January 19, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. Fixed in mutt 1.14.7-r0.

References

Show 61 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open