Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to "backtracking into the phrase," a different vulnerability than CVE-2014-0477.

Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address.

It was discovered [1] that there's a denial of service vulnerability in Email::Address, a Perl module for RFC 2822 address parsing and creation [2]. Email::Address::parse uses significant time on parsing empty quoted string, as allowed by RFC 2822.

Suggested fix was applied upstream as [3] contained in a new upstream version 1.905 [4] which contain additional commits [5] to avoid slowdowns.

[1] http://seclists.org/oss-sec/2014/q2/563 [2] https://metacpan.org/release/Email-Address [3] https://github.com/rjbs/Email-Address/commit/83f8306 [4] https://metacpan.org/release/RJBS/Email-Address-1.905 [5] https://github.com/rjbs/Email-Address/blob/432d10e/Changes

The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused this problem contained 30 form-field characters ("\f").