Resource exhaustion in Rjbs Email-Mime
CVE-2024-4140
An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
EPSS: 0.011 (63.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Rjbs Email-mime — versions 0
- Fedoraproject Fedora — versions 39, 40
Weakness classification (CWE)
References
- security@ubuntu.com (issue-tracking, Issue Tracking)
- security@ubuntu.com (issue-tracking, Issue Tracking)
- security@ubuntu.com (issue-tracking, Mailing List)
- security@ubuntu.com (issue-tracking, Third Party Advisory)
- security@ubuntu.com (Patch, patch)
- security@ubuntu.com (Patch, patch)
- security@ubuntu.com (Patch, patch)
- security@ubuntu.com (Patch, patch)
- security@ubuntu.com (Patch, patch)
- security@ubuntu.com (Patch, patch)
Frequently asked questions
- What is CVE-2024-4140?
- CVE-2024-4140 is a high-severity vulnerability in Rjbs Email-Mime, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 7.5/10. Published 2024-05-02.
- How severe is CVE-2024-4140?
- High severity. CVSS v3 base score is 7.5 out of 10.