CVE-2021-3181

Name	CVE-2021-3181
Description	rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2529-1, DSA-4838-1
Debian Bugs	980326

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mutt (PTS)	buster	1.10.1-2.1+deb10u6	fixed
	buster (security)	1.10.1-2.1+deb10u7	fixed
	bullseye (security), bullseye	2.0.5-4.1+deb11u3	fixed
	bookworm	2.2.12-0.1~deb12u1	fixed
	bookworm (security)	2.2.9-1+deb12u1	fixed
	sid, trixie	2.2.12-0.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
mutt	source	stretch	1.7.2-1+deb9u5	DLA-2529-1
mutt	source	buster	1.10.1-2.1+deb10u5	DSA-4838-1
mutt	source	(unstable)	2.0.5-1		980326

https://gitlab.com/muttmua/mutt/-/issues/323
https://gitlab.com/muttmua/mutt/-/commit/4a2becbdb4422aaffe3ce314991b9d670b7adf17