p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de postal-mime

Vulnerabilidades publicadas para postal-mime en los últimos 30 días: 1. Incluidas en el catálogo KEV: 0.

Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 1

  1. GHSA-f2hq-32vh-53cc

    Alta · CVSS 7.5Corrección disponible

    postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

    ### Impact Decoding a header that holds a long run of joinable RFC 2047 base64 encoded words, such as `=?utf-8?B?QUJD?=` repeated tens of thousands of times in a `Subject`, `From`, `To`, a filename or a description, took time quadratic in the number of words. The join check ran a regex over the text joined so far for every word, which flattens the accumulated string each time. A single well formed message of about 1.6 MB blocked the event loop for one to twenty seconds depending on the host, and inline `message/rfc822` parts multiplied the cost, since each nested message carried its own header budget. Any application that parses untrusted m

    • Actualiza a 4.0.8
    Publicación Actualización

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →