Vulnerability
CVE-2008-2829
CVE-2008-2829 is a medium-severity vulnerability (CVSS v2 5.0). As of 2026-10-11, 8 968 hosts in our data show software it affects on an open service in at least 15 countries.
php_imap.c in PHP 5.2.5, 5.2.6, 4.x, and other versions, uses obsolete API calls that allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long IMAP request, which triggers an "rfc822.c legacy routine buffer overflow" error message, related to the rfc822_write_address function.
- Published
- 2008-06-23
- Last modified
- 2026-06-16
- CVSS score
- 5.0 CVSS v2
- CVSS vector (v2)
- AV:N/AC:L/Au:N/C:N/I:N/A:P
- Exploit likelihood (EPSS)
- 5.3% in the next 30 days (top 8% of CVEs)
Exposure in our data
8 968 hosts
Hosts whose banner shows an affected software version on a service open at their latest check.
Not counted: 20 hosts with this CVE only from an older observation.
Not counted: 5 hosts where the software version is too vague to tell (only a major release).
Not counted: 1 181 more on distribution builds that may be patched (the distribution may have backported the fix without changing the version).
17 more hosts had it earlier (the software version has since changed or the service is gone).
Counted 2026-10-11 04:20 UTC
By country
| United States US | 7 067 |
| Canada CA | 320 |
| Germany DE | 204 |
| Italy IT | 187 |
| South Korea KR | 160 |
| Japan JP | 136 |
| Taiwan TW | 89 |
| France FR | 84 |
| China CN | 62 |
| Poland PL | 57 |
| Sweden SE | 54 |
| Russia RU | 53 |
| Spain ES | 52 |
| Iran IR | 52 |
| Thailand TH | 40 |
Affected software seen
| php 4.4.0 | 6 784 |
| php 5.2.6 | 485 |
| php 4.3.3 | 388 |
| php 4.4.9 | 281 |
| php 4.3.10 | 244 |
| php 5.2.5 | 148 |
| php 4.1.2 | 98 |
| php 4.4.2 | 76 |
| php 4.4.7 | 70 |
| php 4.3.11 | 51 |
| php 4.4.4 | 49 |
| php 4.3.9 | 48 |