CVE-2019-12420: Apache Spamassassin

High severity, CVSS 7.5. EPSS: 7.2% chance of exploitation in the next 30 days.

In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.

Affected products

• Apache Spamassassin: before 3.4.3 (fixed in 3.4.3)
• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only

Published 2019-12-12. Last modified 2026-06-17.