CVE catalog

CVE-2018-12558

libemail-address-perl: CVE-2018-12558

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.67% · Oct 25, 2026

The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused this problem contained 30 form-field characters ("\f").

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibemail-address-perlsid1.913-1fixed
Debianlibemail-address-perlforky1.913-1fixed
Debianlibemail-address-perltrixie1.913-1fixed
Debianlibemail-address-perlbookworm1.913-1fixed
Alpineperl-email-address3.101.912-r0fixed
Alpineperl-email-address3.111.912-r0fixed
Alpineperl-email-address3.121.912-r0fixed
Alpineperl-email-address3.131.912-r0fixed
Alpineperl-email-address3.141.912-r0fixed
Alpineperl-email-address3.151.912-r0fixed
Alpineperl-email-address3.161.912-r0fixed
Alpineperl-email-address3.171.912-r0fixed
Alpineperl-email-address3.181.912-r0fixed
Alpineperl-email-address3.191.912-r0fixed
Alpineperl-email-address3.201.912-r0fixed
Alpineperl-email-address3.211.912-r0fixed
Alpineperl-email-address3.221.912-r0fixed
Alpineperl-email-address3.231.912-r0fixed
Alpineperl-email-address3.241.912-r0fixed
Alpineperl-email-address3.71.912-r0fixed
Alpineperl-email-address3.81.912-r0fixed
Alpineperl-email-address3.91.912-r0fixed
Suseperl-Email-Addresspackage hub 151.912-bp150.3.3.1fixed
Opensuseperl-Email-Addressleap 15.01.912-bp150.3.3.1fixed
Opensuseperl-Email-Addresstumbleweed1.913-1.1fixed
Ubuntulibemail-address-perl16.041.905-2vulnerable
Ubuntulibemail-address-perl16.041.908-1vulnerable
Ubuntulibemail-address-perl18.041.908-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibemail-address-perlsourcesid1.912-1unimportantNot reported[901873]
Debianlibemail-address-perlsourceforky1.912-1unimportantNot reported[901873]
Debianlibemail-address-perlsourcetrixie1.912-1unimportantNot reported[901873]
Debianlibemail-address-perlsourcebookworm1.912-1unimportantNot reported[901873]
Alpineperl-email-addressapk3.101.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.111.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.121.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.131.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.141.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.151.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.161.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.171.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.181.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.191.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.201.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.211.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.221.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.231.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.241.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.71.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.81.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Alpineperl-email-addressapk3.91.912-r0Not reportedALPINE-CVE-2018-12558Not reported
Suseperl-Email-Addressrpmpackage hub 151.912-bp150.3.3.1Not reportedOPENSUSE-SU-2019:1114-1Not reported
Opensuseperl-Email-Addressrpmleap 15.01.912-bp150.3.3.1Not reportedOPENSUSE-SU-2019:1114-1Not reported
Opensuseperl-Email-Addressrpmtumbleweed1.913-1.1Not reportedOPENSUSE-SU-2024:12651-1Not reported

[Debian bug #901873]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libemail-address-perl]Fixed
    Details (2)

    • 1.913-1 · all · bookworm

      Fixed · Fixed: 1.912-1

      dsa · libemail-address-perl · debian · bookworm; dsa · libemail-address-perl · debian · 12

    • 1.913-1 · all · bookworm

      Fixed · Fixed: 1.912-1

      dsa · libemail-address-perl · debian · bookworm; dsa · libemail-address-perl · debian · 12

[Debian 13 (Trixie)]

  • [libemail-address-perl]Fixed
    Details (2)

    • 1.913-1 · all · trixie

      Fixed · Fixed: 1.912-1

      dsa · libemail-address-perl · debian · 13

    • 1.913-1 · all · trixie

      Fixed · Fixed: 1.912-1

      dsa · libemail-address-perl · debian · 13

[openSUSE Tumbleweed]

  • [perl-Email-Address]Fixed

    Source package: [perl-Email-Address]

    Details (1)

    • 1.913-1.12 · noarch · tumbleweed

      Fixed · Fixed: 1.913-1.1

      dsa · perl-Email-Address · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]