← Vulnerability feed

Vulnerability record · CVE-2005-1266 · published 15 June 2005

CVE-2005-1266: Apache spamassassin vulnerability

Apache · Spamassassin

Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header without any boundaries.

5.0 CVSS 2.0 Medium EPSS 8.3% · top 5.2%
5.0CVSS 2.0 base score
8.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
18References
16 Jun 2026Last modified by NVD

Description

Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header without any boundaries.

AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://bugs.gentoo.org/show_bug.cgi?id=94722 Patch
http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288%40proton.pathnam
http://security.gentoo.org/glsa/glsa-200506-17.xml Patch
http://www.debian.org/security/2005/dsa-736
http://www.mandriva.com/security/advisories?name=MDKSA-2005:106
http://www.redhat.com/support/errata/RHSA-2005-498.html
http://www.securityfocus.com/bid/13978
http://www.vuxml.org/freebsd/cc4ce06b-e01c-11d9-a8bd-000cf18bbe54.html Patch
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10901
http://bugs.gentoo.org/show_bug.cgi?id=94722 Patch
http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288%40proton.pathnam
http://security.gentoo.org/glsa/glsa-200506-17.xml Patch
http://www.debian.org/security/2005/dsa-736
http://www.mandriva.com/security/advisories?name=MDKSA-2005:106
http://www.redhat.com/support/errata/RHSA-2005-498.html
http://www.securityfocus.com/bid/13978
http://www.vuxml.org/freebsd/cc4ce06b-e01c-11d9-a8bd-000cf18bbe54.html Patch
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10901

Track CVE-2005-1266 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-1946Apache spamassassin os command injection vulnerabilityIn Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. …EPSS 6.1%9.8CVE-2018-11780Apache spamassassin code injection vulnerabilityA potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.EPSS 11%8.1CVE-2020-1930Apache spamassassin os command injection vulnerabilityA command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configur…EPSS 7.1%8.1CVE-2020-1931Apache spamassassin os command injection vulnerabilityA command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to…EPSS 6.5%7.8CVE-2018-11781Apache spamassassin code injection vulnerabilityApache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.EPSS 0.98%7.8CVE-2016-1238Debian linux permissions and access controls vulnerability(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/…EPSS 0.78%7.5CVE-2019-12420Apache spamassassin uncontrolled resource consumption vulnerabilityIn Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the r…EPSS 7.2%6.7CVE-2018-11805Apache spamassassin os command injection vulnerabilityIn Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits ca…EPSS 0.87%

Source: NIST National Vulnerability Database (record CVE-2005-1266), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.