CVE-2026-116267: MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message.
Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MIME-toolsto a version that resolves this vulnerability.Fixed in 5.521
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Deployments using MIME::Parser before version 5.521 are exposed when they parse truncated, deeply nested messages. The default configuration has no nesting-depth limit, so no nondefault setting is required for the condition described.
What must an attacker provide to trigger the memory exhaustion?
An attacker needs to cause the parser to process a deeply nested message that ends before its closing boundaries. At each nesting level, the parser stores an indented diagnostic, causing diagnostic memory growth proportional to the square of the nesting depth.
How can I determine whether an installation is affected?
Check the installed MIME::Parser version. Versions before 5.521 are affected; version 5.521 is identified by the provided change reference as the release addressing this issue.