← Vulnerability feed

Vulnerability record · CVE-2005-3351 · published 20 November 2005

CVE-2005-3351: Apache spamassassin vulnerability

Apache · Spamassassin

SpamAssassin 3.0.4 allows attackers to bypass spam detection via an e-mail with a large number of recipients ("To" addresses), which triggers a bus error in Perl.

5.0 CVSS 2.0 Medium EPSS 7.3% · top 5.9%
5.0CVSS 2.0 base score
7.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
34References
16 Jun 2026Last modified by NVD

Description

SpamAssassin 3.0.4 allows attackers to bypass spam detection via an e-mail with a large number of recipients ("To" addresses), which triggers a bus error in Perl.

AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4570
http://lwn.net/Alerts/159300/ PatchVendor Advisory
http://osvdb.org/11581
http://secunia.com/advisories/17386/
http://secunia.com/advisories/17518/
http://secunia.com/advisories/17626/
http://secunia.com/advisories/17666/
http://secunia.com/advisories/17877
http://secunia.com/advisories/19158
http://www.gossamer-threads.com/lists/spamassassin/devel/62649 PatchVendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:221
http://www.novell.com/linux/security/advisories/2005_27_sr.html
http://www.redhat.com/support/errata/RHSA-2006-0129.html
http://www.securityfocus.com/bid/15373
http://www.vupen.com/english/advisories/2005/2364
https://exchange.xforce.ibmcloud.com/vulnerabilities/23048
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11125
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4570
http://lwn.net/Alerts/159300/ PatchVendor Advisory
http://osvdb.org/11581
http://secunia.com/advisories/17386/
http://secunia.com/advisories/17518/
http://secunia.com/advisories/17626/
http://secunia.com/advisories/17666/
http://secunia.com/advisories/17877
http://secunia.com/advisories/19158
http://www.gossamer-threads.com/lists/spamassassin/devel/62649 PatchVendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:221
http://www.novell.com/linux/security/advisories/2005_27_sr.html
http://www.redhat.com/support/errata/RHSA-2006-0129.html
http://www.securityfocus.com/bid/15373
http://www.vupen.com/english/advisories/2005/2364
https://exchange.xforce.ibmcloud.com/vulnerabilities/23048
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11125

Track CVE-2005-3351 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-1946Apache spamassassin os command injection vulnerabilityIn Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. …EPSS 6.1%9.8CVE-2018-11780Apache spamassassin code injection vulnerabilityA potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.EPSS 11%8.1CVE-2020-1930Apache spamassassin os command injection vulnerabilityA command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configur…EPSS 7.1%8.1CVE-2020-1931Apache spamassassin os command injection vulnerabilityA command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to…EPSS 6.5%7.8CVE-2018-11781Apache spamassassin code injection vulnerabilityApache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.EPSS 0.98%7.8CVE-2016-1238Debian linux permissions and access controls vulnerability(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/…EPSS 0.78%7.5CVE-2019-12420Apache spamassassin uncontrolled resource consumption vulnerabilityIn Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the r…EPSS 7.2%6.7CVE-2018-11805Apache spamassassin os command injection vulnerabilityIn Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits ca…EPSS 0.87%

Source: NIST National Vulnerability Database (record CVE-2005-3351), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.