What’s Vulnerable › Vulnerabilities

CVE-2018-18898

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-03-21 · updated 2026-06-17
• Weakness: CWE-400

Description

The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorithmic complexity attack on email address parsing.

Affected products

• Best Practical Request Tracker: from 4.1.13 through 4.4.0
• Canonical Ubuntu Linux: 16.04, 18.04
• Debian Linux: 8.0, 10.0
• Fedoraproject Fedora: 28, 29

References

• https://bestpractical.com/download-page
• https://lists.debian.org/debian-lts-announce/2020/02/msg00009.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CPJVDT77ZPRU5Z2BEMZM7EBY6WZHUATZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR46PPHBEM76DNN4DEQMAYIKLCO3TQU2/
• https://usn.ubuntu.com/4517-1/
• https://bestpractical.com/download-page
• https://lists.debian.org/debian-lts-announce/2020/02/msg00009.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CPJVDT77ZPRU5Z2BEMZM7EBY6WZHUATZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR46PPHBEM76DNN4DEQMAYIKLCO3TQU2/
• https://usn.ubuntu.com/4517-1/

Get alerted when CVE-2018-18898 or the next vulnerability affects your stack