DEBIAN-CVE-2026-116273: Debian/libmime-tools-perl vulnerability

Published Oct 28, 2026

Updated

MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion. The maxparts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has. Version 5.521 sets maxparts to 1000 and maxdepth to 64 by default. Setting either to -1 still removes the limit.

Affected Software

3 affected components

debian/libmime-tools-perl*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MIME::Parser to a version that resolves this vulnerability.
Fixed in 5.521

Event History

Oct 28, 2026

CVE Published

via OSV·06:17 PM

Data Sourced

via OSV·06:17 PM

DescriptionAffected Software

Frequently Asked Questions

Are applications using the parser's default settings exposed?

Yes. Before version 5.521, the default max_parts value was -1, which disables the message-part limit. A default parser can therefore create an entity for every MIME part in an arbitrarily large message.

What does an attacker need to exploit this issue?

An attacker needs to cause the application to parse a MIME message containing a very large number of parts. Processing those parts can exhaust available memory.

What changes in version 5.521?

Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. These defaults limit the number of parsed parts and nesting depth.

Can the issue still occur after upgrading?

Yes, if max_parts or max_depth is explicitly set to -1. A value of -1 removes the corresponding limit.

DEBIAN-CVE-2026-116273: Debian/libmime-tools-perl vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Are applications using the parser's default settings exposed?

What does an attacker need to exploit this issue?

What changes in version 5.521?

Can the issue still occur after upgrading?

Company

Resources

Contact

Frequently Asked Questions

Are applications using the parser's default settings exposed?

What does an attacker need to exploit this issue?

What changes in version 5.521?

Can the issue still occur after upgrading?