{"id":"CVE-2026-116267","kind":"vulnerability","aliases":["CVE-2026-116267"],"related":[],"title":"Perl MIME::Parser: truncated deep nesting exhausts memory when parsing mail","description":"MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message.\n\nEach stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.","summary":"MIME::Parser before 5.521 stores an error message at every nesting level of a truncated, deeply nested email, and each message is indented further than the last, so stored diagnostics grow with the square of the nesting depth. An attacker who sends such a message can exhaust the memory of the process parsing it, causing a denial of service.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","mime-parser","package","perl","self-hosted"],"not_affected_if":["no-untrusted-mail-input"],"how_to_check":"- Check the installed MIME::Parser version with `perl -MMIME::Parser -e 'print $MIME::Parser::VERSION'`\n- Look for code that calls MIME::Parser on untrusted mail and whether a nesting depth limit is set (unknown if the sources give the option name)","fix":"- Upgrade MIME::Parser to `5.521` or later\n- Until upgraded, limit the size or nesting depth of messages passed to the parser (unknown if the sources give a specific setting)","status":"open","published_at":"2026-10-28T18:17:13+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:35:28+00:00","updated_at":"2026-10-28T18:35:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T18:35:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MIME::Parser to `5.521` or later\n- Until upgraded, limit the size or nesting depth of messages passed to the parser (unknown if the sources give a specific setting)","reach":"internet","title":"Perl MIME::Parser: truncated deep nesting exhausts memory when parsing mail","impact":"medium","summary":"MIME::Parser before 5.521 stores an error message at every nesting level of a truncated, deeply nested email, and each message is indented further than the last, so stored diagnostics grow with the square of the nesting depth. An attacker who sends such a message can exhaust the memory of the process parsing it, causing a denial of service.","category":"package","nicknames":[],"who_cares":["perl","mime-parser","email","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker exhausts parser process memory, causing denial of service.","analyst_note":"Check the NVD entry and the MIME::Parser 5.521 changelog to confirm the fix version and whether a configurable nesting limit exists.","how_to_check":"- Check the installed MIME::Parser version with `perl -MMIME::Parser -e 'print $MIME::Parser::VERSION'`\n- Look for code that calls MIME::Parser on untrusted mail and whether a nesting depth limit is set (unknown if the sources give the option name)","needs_analyst":true,"not_affected_if":["no-untrusted-mail-input"],"who_is_affected":"Teams whose Perl code uses MIME::Parser to parse email from outside sources, such as mail gateways, ticket systems or inbound-mail handlers, are exposed. The defaults place no limit on nesting depth, so the default configuration is affected. Systems that never parse untrusted MIME input can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":3351,"output_tokens":652,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116267':14A,17A '-2026':13A,16A '5.521':30B,90C 'allow':93C 'attack':66B 'boundari':129C 'caus':81B 'close':128C 'cve':12A,15A 'deep':5A,124C 'deepli':42B,103C 'default':150C 'denial':83B 'depth':64B,138C,156C 'diagnost':56B,109C,142C 'email':18B,44B 'end':125C 'error':33B,98C,134C 'everi':36B,130C 'exhaust':7A,73B,95C 'grow':57B,143C 'host':26B 'indent':49B,97C,111C 'last':53B 'level':38B,117C,123C,131C 'limit':153C 'log':132C 'mail':11A 'memori':8A,75B,94C 'messag':34B,47B,71B,99C,105C,120C 'mime':2A,20B,27B,86C 'mime-pars':19B 'n':122C,148C 'nest':6A,37B,43B,63B,104C,116C,121C,155C 'packag':22B 'pars':10A,79B 'parser':3A,21B,28B,87C,108C 'per':115C 'perl':1A,23B,92C 'place':151C 'process':78B 'self':25B 'self-host':24B 'send':68B 'servic':85B 'space':114C 'squar':60B,146C 'store':31B,55B,107C,141C 'three':113C 'truncat':4A,41B,102C 'version':88C 'via':96C 'without':126C","nicknames":[],"mitigations":[],"who_affected":"Teams whose Perl code uses MIME::Parser to parse email from outside sources, such as mail gateways, ticket systems or inbound-mail handlers, are exposed. The defaults place no limit on nesting depth, so the default configuration is affected. Systems that never parse untrusted MIME input can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116267","severity":null,"published_at":"2026-10-28T18:17:13+00:00","modified_at":"2026-10-28T18:17:13+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}