Description
Vipul Razor Agents (razor-agents) before 2.70 allows remote attackers to cause a denial of service via (1) certain "unusual HTML messages" or (2) "certain malformed headers" such as Content-Type.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | razor | 2.720-1 | — |
| Debian 13 | razor | 2.720-1 | — |
| Debian 12 | razor | 2.720-1 | — |
| Debian 3.1 | razor | 2.670-1sarge2 | DSA-738-1 |
Advisories 1
- DSA-738-1 razor - email header parsing error Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200506-17 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=95492
- SUSE-SA:2005:035 vendor-advisory
- 13984 vdb-entry
- http://sourceforge.net/mailarchive/forum.php?thread_id=7520323&forum_id=4259
- DSA-738 vendor-advisory