{"id":"CVE-2021-3181","aliases":["ALPINE-CVE-2021-3181","ALSA-2021:4181","DEBIAN-CVE-2021-3181","DLA-2529-1","DSA-4838-1","EUVD-2021-26524","GHSA-prp6-7gc9-4jmw","MGASA-2021-0070","OESA-2021-1079","RHSA-2021:4181","RLSA-2021:4181","SUSE-SU-2021:0195-1","SUSE-SU-2021:0196-1","UBUNTU-CVE-2021-3181","USN-4703-1","openSUSE-SU-2021:0161-1","openSUSE-SU-2021:0162-1","openSUSE-SU-2024:11069-1"],"status":"published","title":"rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox...","description":"rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0283,"percentile":0.86718,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-401"],"published":"2021-01-19T14:30:37Z","modified":"2026-11-03T06:32:33Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"mutt","fixed_in":["1.14.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"mutt","fixed_in":["2.0.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"mutt","fixed_in":["2.0.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"mutt","fixed_in":["2.0.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"mutt","fixed_in":["2.0.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"mutt","fixed_in":["2.0.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"mutt","fixed_in":["2.0.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"mutt","fixed_in":["2.0.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"mutt","fixed_in":["2.0.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"mutt","fixed_in":["2.0.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"mutt","fixed_in":["2.0.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"mutt","fixed_in":["2.0.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"mutt","fixed_in":["2.0.4-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mutt","fixed_in":["2.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mutt","fixed_in":["2.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mutt","fixed_in":["2.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"mutt","fixed_in":["1.7.2-1+deb9u5"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"mutt","fixed_in":["1.10.1-2.1+deb10u5"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"mutt","fixed_in":["1.11.4-1.5.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS","package":"mutt","fixed_in":["1.10.1-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"mutt","fixed_in":["1.10.1-5.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"mutt","fixed_in":["1.10.1-3.20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"mutt","fixed_in":["1.10.1-55.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"mutt","fixed_in":["1.10.1-55.24.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"mutt","fixed_in":["1.5.24-1ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"mutt","fixed_in":["1.9.4-3ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"mutt","fixed_in":["1.13.2-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"mutt","fixed_in":["1.10.1-lp151.2.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"mutt","fixed_in":["1.10.1-lp152.3.15.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.0.7-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-1+deb9u5"}]}],"versions":["1.7.2-1","1.7.2-1+deb9u1","1.7.2-1+deb9u2","1.7.2-1+deb9u3","1.7.2-1+deb9u4"]},{"source":"osv","ecosystem":"Debian:10","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-2.1+deb10u5"}]}],"versions":["1.10.1-2.1","1.10.1-2.1+deb10u1","1.10.1-2.1+deb10u2","1.10.1-2.1+deb10u3","1.10.1-2.1+deb10u4"]},{"source":"osv","ecosystem":"Mageia:7","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.5.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-5.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.0.7-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mutt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.0.7-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mutt-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.0.7-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5:2.0.7-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-3.20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-55.24.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.24-1ubuntu0.6"}]}],"versions":["1.5.23-3.1ubuntu1","1.5.23-3.1ubuntu2","1.5.24-1","1.5.24-1build1","1.5.24-1ubuntu0.1","1.5.24-1ubuntu0.2","1.5.24-1ubuntu0.3","1.5.24-1ubuntu0.4","1.5.24-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3ubuntu0.5"}]}],"versions":["1.8.3+neomutt20170609-2build1","1.9.1-2","1.9.1-3","1.9.1-4","1.9.1-5","1.9.2-1","1.9.3-1","1.9.4-2","1.9.4-3","1.9.4-3ubuntu0.1","1.9.4-3ubuntu0.2","1.9.4-3ubuntu0.3","1.9.4-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-1ubuntu0.4"}]}],"versions":["1.10.1-2.1","1.12.2-1","1.12.2-2","1.13.0-1","1.13.2-1","1.13.2-1ubuntu0.1","1.13.2-1ubuntu0.2","1.13.2-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.24-1ubuntu0.6"}]}],"versions":["1.5.23-3.1ubuntu1","1.5.23-3.1ubuntu2","1.5.24-1","1.5.24-1build1","1.5.24-1ubuntu0.1","1.5.24-1ubuntu0.2","1.5.24-1ubuntu0.3","1.5.24-1ubuntu0.4","1.5.24-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.4-3ubuntu0.5"}]}],"versions":["1.8.3+neomutt20170609-2build1","1.9.1-2","1.9.1-3","1.9.1-4","1.9.1-5","1.9.2-1","1.9.3-1","1.9.4-2","1.9.4-3","1.9.4-3ubuntu0.1","1.9.4-3ubuntu0.2","1.9.4-3ubuntu0.3","1.9.4-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2-1ubuntu0.4"}]}],"versions":["1.10.1-2.1","1.12.2-1","1.12.2-2","1.13.0-1","1.13.2-1","1.13.2-1ubuntu0.1","1.13.2-1ubuntu0.2","1.13.2-1ubuntu0.3"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-lp151.2.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-lp152.3.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mutt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-2.2"}]}],"bundled":21}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mutt","product":"mutt"}],"references":[{"url":"https://gitlab.com/muttmua/mutt/-/issues/323","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://gitlab.com/muttmua/mutt/-/commit/4a2becbdb4422aaffe3ce314991b9d670b7adf17","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://gitlab.com/muttmua/mutt/-/commit/939b02b33ae29bc0d642570c1dcfd4b339037d19","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://gitlab.com/muttmua/mutt/-/commit/d4305208955c5cdd9fe96dfa61e7c1e14e176a14","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2021/01/19/10","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00017.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202101-25","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2021/dsa-4838","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/01/27/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2OMLQKAOHPYQA4GI7ZUO6UKCPUHLYO7/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DXGWXFO77HBCD3VYEIYHHYU33LYWWWNQ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3181","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DXGWXFO77HBCD3VYEIYHHYU33LYWWWNQ/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2OMLQKAOHPYQA4GI7ZUO6UKCPUHLYO7/"},{"url":"https://github.com/advisories/GHSA-prp6-7gc9-4jmw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-3181","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-4181.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-28896","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3181","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3181","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0070.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28159","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/01/19/10","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2021/01/17/2","tags":["web"]},{"url":"https://www.debian.org/lts/security/2021/dla-2529","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-4703-1","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1079","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4181","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1890084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1900826","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1920446","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4181.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28896","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28896","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28896","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3181","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3181","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4181","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210195-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181221","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3181","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210196-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3181","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IEMZ6Y2RB5555R7MDMITJLHGYX4T65C7/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TXFLXGSUQPBN7TELGSNJZPFUX7KMTSBT/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32055","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-3181","description":"rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.","status":"published","published":"2021-01-19T14:30:37Z","modified":"2024-08-03T16:45:51.462Z","updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26524","description":"rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.","status":"published","published":"2021-01-19T14:30:37Z","modified":"2024-08-03T16:45:51Z","updated_at":"2026-11-03T03:25:13.531128Z"}],"ghsa":[{"id":"GHSA-prp6-7gc9-4jmw","title":"rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox...","description":"rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.","status":"published","published":"2022-05-24T17:39:30Z","modified":"2023-01-27T05:03:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:42:09.126228Z"}],"nvd":[{"id":"CVE-2021-3181","description":"rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.","status":"published","published":"2021-01-19T15:15:12.327Z","modified":"2026-06-17T04:04:47.96Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:06:49.284888Z"}],"osv":[{"id":"ALPINE-CVE-2021-3181","description":"rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.","status":"published","published":"2021-01-19T15:15:12.327Z","modified":"2026-11-03T06:32:33.360956323Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2021-3181","description":"rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.","status":"published","published":"2021-01-19T15:15:12.327Z","modified":"2026-10-25T01:16:52.236975205Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"DEBIAN-CVE-2021-3181","description":"rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.","status":"published","published":"2021-01-19T15:15:12.327Z","modified":"2026-10-23T18:03:26.474529482Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"OESA-2021-1079","title":"mutt security update","description":"Mutt is a small but very powerful text-based mail client for Unix operating systems.\r\n\r\nSecurity Fix(es):\r\n\r\nrfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.(CVE-2021-3181)","status":"published","published":"2021-03-05T11:04:18Z","modified":"2026-08-18T01:15:21.64956437Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:4181","title":"Red Hat Security Advisory: mutt security, bug fix, and enhancement update","status":"published","published":"2024-09-16T05:45:22Z","modified":"2025-11-22T12:26:21Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4181","title":"Moderate: mutt security, bug fix, and enhancement update","description":"Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.\n\nThe following packages have been upgraded to a later upstream version: mutt (2.0.7). (BZ#1912614)\n\nSecurity Fix(es):\n\n* mutt: Incorrect handling of invalid initial IMAP responses could lead to an authentication attempt over unencrypted connection (CVE-2020-28896)\n\n* mutt: Memory leak when parsing rfc822 group addresses (CVE-2021-3181)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:33:45Z","modified":"2026-02-04T13:15:05.576605Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-3181","description":"rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.","status":"published","published":"2021-01-19T15:15:00Z","modified":"2026-02-04T04:03:09.979125Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"ALSA-2021:4181","title":"Moderate: mutt security, bug fix, and enhancement update","description":"Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.\n\nThe following packages have been upgraded to a later upstream version: mutt (2.0.7). (BZ#1912614)\n\nSecurity Fix(es):\n\n* mutt: Incorrect handling of invalid initial IMAP responses could lead to an authentication attempt over unencrypted connection (CVE-2020-28896)\n\n* mutt: Memory leak when parsing rfc822 group addresses (CVE-2021-3181)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:33:45Z","modified":"2026-10-29T11:01:09.40931681Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-2529-1","title":"mutt - security update","status":"published","published":"2021-01-21T00:00:00Z","modified":"2026-03-09T01:19:22.310512Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4838-1","title":"mutt - security update","status":"published","published":"2021-01-25T00:00:00Z","modified":"2026-03-09T02:11:21.465144Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0070","title":"Updated mutt packages fix a security vulnerability","description":"It was discovered that Mutt incorrectly handled certain email messages.\nAn attacker could possibly use this issue to cause a denial of service because\nrfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of\nservice (mailbox unavailability) by sending email messages with sequences of\nsemicolon characters in RFC822 address fields (aka terminators of empty groups).\n(CVE-2021-3181).\n\nmutt-1.11.4 has been patched for Mageia 7.\n","status":"published","published":"2021-02-05T11:54:53Z","modified":"2026-04-16T04:41:43.358454787Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0161-1","title":"Security update for mutt","description":"This update for mutt fixes the following issue:\n\n- CVE-2021-3181: Fixed a memory leak in recipient parsing (bsc#1181221).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-01-25T17:23:01Z","modified":"2026-02-04T04:11:49.431287Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0162-1","title":"Security update for mutt","description":"This update for mutt fixes the following issue:\n\n- CVE-2021-3181: Fixed a memory leak in recipient parsing (bsc#1181221).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-01-25T17:23:09Z","modified":"2026-02-04T03:55:57.275688Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11069-1","title":"mutt-2.0.7-2.2 on GA media","description":"These are all security issues fixed in the mutt-2.0.7-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:48.018222Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2021:0195-1","title":"Security update for mutt","description":"This update for mutt fixes the following issue:\n\n- CVE-2021-3181: Fixed a memory leak in recipient parsing (bsc#1181221).\n","status":"published","published":"2021-01-22T14:17:22Z","modified":"2026-02-04T04:14:45.778486Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0196-1","title":"Security update for mutt","description":"This update for mutt fixes the following issue:\n\n- CVE-2021-3181: Fixed a memory leak in recipient parsing (bsc#1181221).\n","status":"published","published":"2021-01-22T14:17:35Z","modified":"2026-02-04T02:14:28.878475Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"USN-4703-1","title":"mutt vulnerability","description":"It was discovered that Mutt incorrectly handled certain email messages.\nAn attacker could possibly use this issue to cause a denial of service.\n","status":"published","published":"2021-01-25T15:08:48Z","modified":"2026-02-10T04:42:02Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}