Description
SpamAssassin 2.5x, and 2.6x before 2.64, allows remote attackers to cause a denial of service via certain malformed messages.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | spamassassin | 2.64 | — |
| Debian 13 | spamassassin | 2.64 | — |
| Debian 12 | spamassassin | 2.64 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | spamassassin | 2.55-3.2 | RHSA-2004:451 |
Advisories 1
- RHSA-2004:451 Red Hat Security Advisory: spamassassin security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- GLSA-200408-06 vendor-advisory
- spamassassin-dos(16938) vdb-entry
- 10957 vdb-entry
- MDKSA-2004:084 vendor-advisory
- oval:org.mitre.oval:def:10413 vdb-entry signature
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129337
- [spamassassin-announce] 20040805 [SA-Announce] SpamAssassin 2.64 is released! mailing-list
- FLSA:2268 vendor-advisory