{"id":"CVE-2014-4720","aliases":["DEBIAN-CVE-2014-4720","DSA-2969-1","EUVD-2014-4639","GHSA-6jmv-rp6j-xp29","MGASA-2014-0389","UBUNTU-CVE-2014-4720"],"status":"published","title":"Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows...","description":"Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to \"backtracking into the phrase,\" a different vulnerability than CVE-2014-0477.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01864,"percentile":0.79401,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2014-06-27T00:00:00Z","modified":"2026-10-23T15:47:33Z","fixes":[{"ecosystem":"Debian:12","package":"libemail-address-perl","fixed_in":["1.905-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libemail-address-perl","fixed_in":["1.905-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libemail-address-perl","fixed_in":["1.905-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libemail-address-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.905-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libemail-address-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.905-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libemail-address-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.905-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"libemail-address-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.895-1+deb7u1"}]}],"versions":["1.895-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"perl-Email-Address","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.905.0-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"perl-Email-Address","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.905.0-1.mga4"}]}],"bundled":2}],"products":[{"vendor":"email\\","product":"\\"}],"references":[{"url":"http://seclists.org/oss-sec/2014/q2/563","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"https://github.com/rjbs/Email-Address/blob/master/Changes","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-4720"},{"url":"https://github.com/advisories/GHSA-6jmv-rp6j-xp29"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-4720","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0389.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13541","tags":["report"]},{"url":"https://www.debian.org/security/2014/dsa-2969","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-4720","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-4720","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-4720","description":"Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to \"backtracking into the phrase,\" a different vulnerability than CVE-2014-0477.","status":"published","published":"2014-07-06T23:00:00Z","modified":"2024-09-16T22:56:23.596Z","updated_at":"2026-11-02T14:33:45.604635Z"}],"euvd":[{"id":"EUVD-2014-4639","description":"Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to \"backtracking into the phrase,\" a different vulnerability than CVE-2014-0477.","status":"published","published":"2014-07-06T23:00:00Z","modified":"2024-09-16T22:56:23Z","updated_at":"2026-11-03T00:54:58.273879Z"}],"ghsa":[{"id":"GHSA-6jmv-rp6j-xp29","title":"Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows...","description":"Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to \"backtracking into the phrase,\" a different vulnerability than CVE-2014-0477.","status":"published","published":"2022-05-17T04:40:41Z","modified":"2023-01-28T05:02:09Z","updated_at":"2026-11-02T14:43:43.514522Z"}],"nvd":[{"id":"CVE-2014-4720","description":"Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to \"backtracking into the phrase,\" a different vulnerability than CVE-2014-0477.","status":"published","published":"2014-07-06T23:55:02.05Z","modified":"2026-06-17T00:10:30.39Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:54.827864Z"}],"osv":[{"id":"CVE-2014-4720","description":"Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to \"backtracking into the phrase,\" a different vulnerability than CVE-2014-0477.","status":"published","published":"2014-07-06T23:55:02Z","modified":"2026-04-16T06:25:05.777002411Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-4720","description":"Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to \"backtracking into the phrase,\" a different vulnerability than CVE-2014-0477.","status":"published","published":"2014-07-06T23:55:02.05Z","modified":"2026-10-23T15:47:33.96074966Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DSA-2969-1","title":"libemail-address-perl - security update","status":"published","published":"2014-06-27T00:00:00Z","modified":"2026-03-09T01:19:29.239473Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0389","title":"Updated perl-Email-Address packages fix security vulnerabilities","description":"Updated perl-Email-Address package fixes security vulnerability:\n\nThe parse function in Email::Address module before 1.905 for Perl uses an\ninefficient regular expression, which allows remote attackers to cause a\ndenial of service (CPU consumption) via an empty quoted string in an RFC 2822\naddress (CVE-2014-0477).\n\nThe Email::Address module before 1.904 for Perl uses an inefficient regular\nexpression, which allows remote attackers to cause a denial of service (CPU\nconsumption) via vectors related to \"backtracking into the phrase\"\n(CVE-2014-4720).\n","status":"published","published":"2014-09-26T15:55:04Z","modified":"2026-04-16T06:25:03.676897229Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-4720","description":"Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to \"backtracking into the phrase,\" a different vulnerability than CVE-2014-0477.","status":"withdrawn","published":"2014-07-06T23:55:00Z","modified":"2025-07-16T07:17:18.85761Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}