{"schema_version":"public-product-v1.1","generated_at":"2026-07-21T12:03:33Z","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","advisory":{"id":"Cisco-SA-20141223-CVE-2014-8016","slug":"cisco-sa-20141223-cve-2014-8016","vendor":"Cisco","title":"Cisco IronPort ESA Subject Header Length Denial of Service Vulnerability","summary":"A vulnerability in Subject header length processing on Cisco IronPort Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a limited denial of service (DoS) condition on an affected platform. The vulnerability occurs because the appliance does not limit the length of Subject headers sent through the appliance. An attacker could exploit this vulnerability by sending multiple crafted messages across the appliance, resulting in high CPU utilization. Continued high CPU utilization may cause a DoS condition on the platform. Cisco has confirmed the vulnerability in a security notice; however, software updates are not available. If attackers successfully cause a DoS condition on an affected device, processing of incoming email may stop, impacting internal email users.","severity":"Medium","published_at":"2014-12-23T21:04:34Z","updated_at":"2014-12-23T21:04:34Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20141223-CVE-2014-8016","csaf_url":"https://sec.cloudapps.cisco.com/security/center/contentjson/CiscoSecurityAdvisory/Cisco-SA-20141223-CVE-2014-8016/csaf/Cisco-SA-20141223-CVE-2014-8016.json","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure."},"freshness":{"last_source_refreshed_at":"2026-07-21T05:16:34Z","latest_source_refresh_at":"2026-07-21T05:16:34Z","oldest_source_refresh_at":"2026-07-21T03:00:03Z","all_sources_fresh":true,"sources":[{"source":"cisco_advisories","label":"Cisco advisories","last_success_at":"2026-07-21T03:00:03Z","stale":false},{"source":"cisco_csaf","label":"Cisco CSAF","last_success_at":"2026-07-21T05:14:24Z","stale":false},{"source":"nvd_cves","label":"NVD CVEs","last_success_at":"2026-07-21T05:16:30Z","stale":false},{"source":"cisa_kev","label":"CISA KEV","last_success_at":"2026-07-21T05:16:31Z","stale":false},{"source":"first_epss","label":"EPSS","last_success_at":"2026-07-21T05:16:34Z","stale":false}]},"summary":{"cve_count":1,"visible_product_count":1,"public_evidence_count":1,"kev_count":0,"highest_epss":0.01232},"cves":[{"id":"CVE-2014-8016","kev":false,"epss":{"score":0.01232,"percentile":0.65656,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"}}],"public_evidence":[{"product":{"name":"Cisco IronPort Email Security Appliance","slug":"cisco-ironport-email-security-appliance","vendor":"Cisco"},"cve":{"id":"CVE-2014-8016"},"evidence_type":"structured_affected","evidence_label":{"scope":"CSAF product evidence","label":"product_status known affected"},"evidence_source":"Cisco CSAF","source":"Cisco CSAF","source_document_fetched_at":"2026-07-20T04:07:48Z","csaf_status":"known_affected","csaf_product_status":"known_affected","csaf_product_status_path":"vulnerabilities[].product_status.known_affected","raw_product_name":"Cisco IronPort Email Security Appliance","exposure_verdict":"not_assessed","verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","exposure_verdict_reason":"Public evidence does not evaluate exact release, platform, enabled features, configuration, compensating controls, or live exposure.","kev":false,"epss":{"score":0.01232,"score_date":"2026-07-20","updated_at":"2026-07-21T05:16:32Z"},"published_at":"2014-12-23T21:04:34Z","updated_at":"2014-12-23T21:04:34Z","advisory_updated_at":"2014-12-23T21:04:34Z","source_url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20141223-CVE-2014-8016","row_display_order":1}]}