Denial of Service Vulnerability in Apache SpamAssassin by The Apache Software Foundation

CVE-2017-15705

Summary

A denial of service vulnerability exists in Apache SpamAssassin prior to version 3.4.2, linked to the mishandling of unclosed HTML tags in emails. When certain malformed HTML is parsed, the Apache SpamAssassin's use of HTML::Parser may lead to improper event handling, resulting in scan timeouts. This flaw can allow attackers to send carefully crafted emails that invoke excessive scan times, potentially disrupting email filtering services. Although the vulnerability has been exploited in the past, it hasn't been conclusively tied to malicious intentions. Future exploitation attempts cannot be ruled out.

References