CVE-2026-116273: MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion
MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion.
The maxparts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has.
Version 5.521 sets maxparts to 1000 and maxdepth to 64 by default. Setting either to -1 still removes the limit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MIME-toolsto a version that resolves this vulnerability.Fixed in 5.521
Event History
Frequently Asked Questions
Which deployments are affected by the unsafe default?
Deployments using MIME::Parser before 5.521 are affected when they create parsers with default settings. In those versions, max_parts defaults to -1, disabling the message-part limit.
What does an attacker need to do to trigger memory exhaustion?
An attacker needs to cause the application to parse a MIME message containing a very large number of parts. The parser builds an entity for every part when no max_parts limit is configured.
Are current default settings protected?
Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Explicitly setting either option to -1 removes its corresponding limit.
What mitigation is available if upgrading is not immediately possible?
Configure a finite max_parts value rather than -1 to limit the number of message parts processed. A finite max_depth value can also limit MIME nesting depth.