Live › vulnerability › CVE-2026-116267
Go to dashboardMIME::Parser before 5.521 stores an error message at every nesting level of a truncated, deeply nested email, and each message is indented further than the last, so stored diagnostics grow with the square of the nesting depth. An attacker who sends such a message can exhaust the memory of the process parsing it, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Teams whose Perl code uses MIME::Parser to parse email from outside sources, such as mail gateways, ticket systems or inbound-mail handlers, are exposed. The defaults place no limit on nesting depth, so the default configuration is affected. Systems that never parse untrusted MIME input can skip it.
No product ranges from the sources yet.
perl -MMIME::Parser -e 'print $MIME::Parser::VERSION'5.521 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message.
Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.
This page as .md · .json · in your agent: get_signal("CVE-2026-116267")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.