PSF-2018-8 Email folding function Denial-of-Service
An attacker can cause a denial of service by sending emails with long headers containing many non-ASCII characters, triggering an infinite loop in the email folding function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is PSF-2018-8?
PSF-2018-8 is a denial of service vulnerability, published on 16 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The email folding function enters an infinite loop if a header is longer than the policy maximum line length and contains many non-ASCII characters.
Regression introduced in Python 3.6.4.
Which versions are affected by PSF-2018-8?
How do I fix PSF-2018-8?
No fix has been published for PSF-2018-8 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is PSF-2018-8 being exploited?
There is no known exploitation of PSF-2018-8 in the wild and no public exploit code.