MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in...
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| https://cpan.org/modules | MIME-tools |
< 5.521 |
5.521 |
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-116270 libmime-tools-perl
- Ubuntu UBUNTU-CVE-2026-116270 libmime-tools-perl
Original description The description as published by the source.
MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords.
For each "=?" that does not start a complete encoded word, decode_mimewords appends an error message containing the whole input string to $@. A boundary of 8,000 "=?" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB.
From version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web metacpan.org
- web nvd.nist.gov
- web github.com