CVE-2026-116267
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level, and when a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.
Risk Assessment
A remote attacker can send a deeply nested MIME message without closing boundaries, exhausting memory in the mail processing process and causing denial of service. This can block mail processing for the entire organization.
Recommendation
Update MIME::Parser to version 5.521 or later. Configure a nesting depth limit for MIME messages in the mail processing pipeline.
Other vulnerabilities in MIME::Parser
See all- CVE-2026-116273Low risk· EPSS 7%
MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion. The max_parts option defaulted to -1 (no limit); version 5.521 sets max_parts to 1000 and max_depth to 64 by default.
- CVE-2026-42504High
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU resources.
Original NVD description (English source)
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS