DEBIAN-CVE-2026-116267: Debian/libmime-tools-perl vulnerability

Published Oct 28, 2026

Updated

MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.

Affected Software

3 affected components

debian/libmime-tools-perl*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MIME::Parser to a version that resolves this vulnerability.
Fixed in 5.521

Event History

Oct 28, 2026

CVE Published

via OSV·06:17 PM

Data Sourced

via OSV·06:17 PM

DescriptionAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Applications using affected MIME::Parser versions to parse untrusted or attacker-controlled MIME messages are exposed. The risk is greatest where messages can be deeply nested and malformed without size or resource limits.

What does an attacker need to do to trigger the memory exhaustion?

An attacker needs to provide a truncated MIME message with deeply nested multipart content that omits closing boundaries. Parsing causes an error to be stored at each nesting level, with indentation increasing at every level.

Are default parser settings affected?

Yes. The described defaults impose no limit on MIME nesting depth, allowing the diagnostic storage to grow quadratically with nesting depth.

What can be done if an upgrade is not immediately possible?

Limit or reject excessively nested MIME messages before parsing, and apply process-level memory or resource limits to services that parse untrusted messages. These measures reduce exposure to deeply nested, truncated input.

DEBIAN-CVE-2026-116267: Debian/libmime-tools-perl vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to do to trigger the memory exhaustion?

Are default parser settings affected?

What can be done if an upgrade is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to do to trigger the memory exhaustion?

Are default parser settings affected?

What can be done if an upgrade is not immediately possible?