CVE-2014-1474: Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2...

Security readout for executives and security teams

This issue can let a remote attacker make an affected RT 4.2 mail/address parsing path consume excessive CPU. The business impact is availability: the service may slow or stop processing requests or email. The provided sources do not show data theft, privilege gain, or confirmed active exploitation. Exposure is most likely where RT 4.2.0 through 4.2.2 is deployed, or where applications directly use Email::Address::List before 0.02. Internet-facing mail ingestion or ticket creation paths increase availability risk. Treat as a targeted availability risk for affected RT deployments, especially if ticket intake is business-critical. Prioritize upgrades during normal maintenance unless service instability or public exposure raises urgency. Mitigation focus: Upgrade Email::Address::List to 0.02 or later where directly used.; Upgrade RT 4.2.0 through 4.2.2 to a fixed vendor-supported release.; Review Best Practical advisory guidance before changing production RT systems..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.