CVE-2026-116270: MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords

Q: Which deployments are exposed to remote exploitation?

Deployments using MIME::Parser from MIME-tools 5.518 or later with a vulnerable MIME::Words version are exposed when they parse attacker-supplied multipart content. A remote sender can trigger the issue with a single Content-Type header containing a crafted multipart boundary.

Q: What input is needed to cause significant memory use?

The multipart boundary must contain repeated "=?" sequences that do not begin complete encoded words. At 8,000 "=?" pairs, a 16,000-byte boundary causes approximately 128 MB to be appended to $@.

Q: What version resolves the issue?

Upgrade MIME::Words to version 5.521 or later. Versions before 5.521 are affected.

Q: What can be done if an upgrade cannot be applied immediately?

Limit or reject multipart boundary values containing repeated incomplete "=?" sequences before they reach MIME::Parser. Also apply input-size and memory limits to processes that parse untrusted MIME messages.

Published Oct 28, 2026

Updated

MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decodemimewords.

For each "=?" that does not start a complete encoded word, decodemimewords appends an error message containing the whole input string to $@. A boundary of 8,000 "=?" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB.

From version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header.

Affected Software

1 affected component

Perl MIME::Words<5.521

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MIME-tools to a version that resolves this vulnerability.
Fixed in 5.521

Event History

Oct 28, 2026

CVE Published

via MITRE·05:33 PM

Data Sourced

via MITRE·05:33 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Deployments using MIME::Parser from MIME-tools 5.518 or later with a vulnerable MIME::Words version are exposed when they parse attacker-supplied multipart content. A remote sender can trigger the issue with a single Content-Type header containing a crafted multipart boundary.

What input is needed to cause significant memory use?

The multipart boundary must contain repeated "=?" sequences that do not begin complete encoded words. At 8,000 "=?" pairs, a 16,000-byte boundary causes approximately 128 MB to be appended to $@.

What version resolves the issue?

Upgrade MIME::Words to version 5.521 or later. Versions before 5.521 are affected.

What can be done if an upgrade cannot be applied immediately?

Limit or reject multipart boundary values containing repeated incomplete "=?" sequences before they reach MIME::Parser. Also apply input-size and memory limits to processes that parse untrusted MIME messages.

CVE-2026-116270: MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What input is needed to cause significant memory use?

What version resolves the issue?

What can be done if an upgrade cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What input is needed to cause significant memory use?

What version resolves the issue?

What can be done if an upgrade cannot be applied immediately?