The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote attackers via an algorit

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• bestpractical request tracker4.1.13 and later · up to 4.4.0 inclusive
• canonical ubuntu linux16.04
• canonical ubuntu linux18.04
• debian debian linux10.0
• debian debian linux8.0
• fedoraproject fedora28
• fedoraproject fedora29

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-44231RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint
  36Monitor
• CVE-2017-5944The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remo
  36Monitor
• CVE-2017-5943Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allows remote attackers to obtain sensitive information
  35Monitor

Published before and after this one in the same product

• ← EarlierCVE-2016-6127Jul 3, 2017 · Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the Al
  24Monitor
• ← EarlierCVE-2017-5361Jul 3, 2017 · Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for se
  23Monitor
• Later →CVE-2021-38562Oct 18, 2021 · Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.