Unrated
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages...
CVE-2026-116267
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| https://cpan.org/modules | MIME-tools |
< 5.521 |
5.521 |
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-116267 libmime-tools-perl
- Ubuntu UBUNTU-CVE-2026-116267 libmime-tools-perl
Original description The description as published by the source.
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message.
Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web metacpan.org
- web nvd.nist.gov
- web github.com