{"id":"CVE-2018-18898","aliases":["ALPINE-CVE-2018-18898","DEBIAN-CVE-2018-18898","DLA-2101-1","EUVD-2018-10608","GHSA-6rmj-6826-5j8h","UBUNTU-CVE-2018-18898","USN-4517-1"],"status":"published","title":"The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of...","description":"The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02356,"percentile":0.83852,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2019-03-17T21:16:19Z","modified":"2026-10-24T10:30:45Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"perl-email-address-list","fixed_in":["0.06-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libemail-address-list-perl","fixed_in":["0.06-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libemail-address-list-perl","fixed_in":["0.06-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libemail-address-list-perl","fixed_in":["0.06-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libemail-address-list-perl","fixed_in":["0.05-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libemail-address-list-perl","fixed_in":["0.05-1+deb9u1build0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libemail-address-list-perl","fixed_in":["0.05-1+deb9u1build0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libemail-address-list-perl","fixed_in":["0.06-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl-email-address-list","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libemail-address-list-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libemail-address-list-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libemail-address-list-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libemail-address-list-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.05-1+deb8u1"}]}],"versions":["0.05-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libemail-address-list-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.05-1+deb9u1build0.16.04.1"}]}],"versions":["0.05-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libemail-address-list-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.05-1+deb9u1build0.18.04.1"}]}],"versions":["0.05-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libemail-address-list-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.06-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libemail-address-list-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.05-1+deb9u1build0.16.04.1"}]}],"versions":["0.05-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libemail-address-list-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.05-1+deb9u1build0.18.04.1"}]}],"versions":["0.05-1"]}],"products":[{"vendor":"bestpractical","product":"request_tracker"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CPJVDT77ZPRU5Z2BEMZM7EBY6WZHUATZ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR46PPHBEM76DNN4DEQMAYIKLCO3TQU2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://bestpractical.com/download-page","tags":["x_refsource_CONFIRM","x_transferred","Product","Release Notes","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/02/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4517-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18898"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CPJVDT77ZPRU5Z2BEMZM7EBY6WZHUATZ/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YR46PPHBEM76DNN4DEQMAYIKLCO3TQU2/"},{"url":"https://github.com/advisories/GHSA-6rmj-6826-5j8h"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-18898","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-18898","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-18898","tags":["report"]},{"url":"https://github.com/bestpractical/email-address-list/commit/a22e6b233443fe3ad1a408e50ecbd7237674817d","tags":["report"]},{"url":"https://github.com/bestpractical/email-address-list/commit/6dd5021a6e5df2e8c86a163dc2e180a76a38e63b","tags":["report"]},{"url":"https://github.com/bestpractical/email-address-list/commit/31bd4dc2dfb26fd6a17e4436df3d3c8904856f30","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4517-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-18898","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-18898","description":"The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.","status":"published","published":"2019-03-17T21:16:19Z","modified":"2024-08-05T11:23:08.241Z","updated_at":"2026-11-02T14:35:11.426178Z"}],"euvd":[{"id":"EUVD-2018-10608","description":"The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.","status":"published","published":"2019-03-17T21:16:19Z","modified":"2024-08-05T11:23:08Z","updated_at":"2026-11-03T02:39:34.768254Z"}],"ghsa":[{"id":"GHSA-6rmj-6826-5j8h","title":"The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of...","description":"The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.","status":"published","published":"2022-05-13T01:16:08Z","modified":"2023-01-28T05:05:28Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:44:20.965343Z"}],"nvd":[{"id":"CVE-2018-18898","description":"The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.","status":"published","published":"2019-03-21T16:00:29.873Z","modified":"2026-06-17T01:48:06.167Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:04:54.21788Z"}],"osv":[{"id":"ALPINE-CVE-2018-18898","description":"The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.","status":"published","published":"2019-03-21T16:00:29.873Z","modified":"2026-10-23T17:17:55.236180737Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2018-18898","description":"The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.","status":"published","published":"2019-03-21T16:00:29.873Z","modified":"2026-10-24T10:30:45.538440071Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-18898","description":"The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.","status":"published","published":"2019-03-21T16:00:29.873Z","modified":"2026-10-23T18:03:03.614846123Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-18898","description":"The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.","status":"published","published":"2019-03-21T16:00:00Z","modified":"2026-02-04T02:56:05.24429Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DLA-2101-1","title":"libemail-address-list-perl - security update","status":"published","published":"2020-02-12T00:00:00Z","modified":"2026-03-09T01:19:04.72216Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"USN-4517-1","title":"libemail-address-list-perl vulnerability","description":"It was discovered that Email-Address-List does not properly parse email \naddresses during email-ingestion. A remote attacker could use this issue\nto cause an algorithmic complexity attack, resulting in a denial of \nservice. (CVE-2018-18898)\n","status":"published","published":"2020-09-17T21:20:32Z","modified":"2026-02-10T04:41:55Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}