CVE-2018-12558

Vulnerability

The parse() method in the Email::Address Perl module (versions through 1.909) is vulnerable to algorithmic complexity due to the use of regular expressions that can exhibit exponential backtracking. Specially crafted input containing 30 form-feed characters ("\f") causes the parser to consume excessive CPU time, leading to a denial of service [1].

Exploitation

An attacker can exploit this vulnerability by sending an email with a crafted From, To, or Cc header containing 30 consecutive form-feed characters. Any application that uses Email::Address->parse() on untrusted email headers will be affected. No authentication or special privileges are required; the attacker only needs to deliver the malicious email to the target system.

Impact

Successful exploitation results in a denial of service (CPU exhaustion) on the system parsing the email. The service may become unresponsive or crash, but no data confidentiality or integrity is compromised.

Mitigation

As of the disclosure date (June 2018), no fixed version of Email::Address has been released. Users should monitor for updates or implement input validation to reject or sanitize email headers containing excessive form-feed characters. Alternatively, consider using a different email address parsing library that is not vulnerable to this issue.