---
id: "CVE-2026-116267"
kind: "vulnerability"
aliases: ["CVE-2026-116267"]
title: "Perl MIME::Parser: truncated deep nesting exhausts memory when parsing mail"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["email", "mime-parser", "package", "perl", "self-hosted"]
not_affected_if: ["no-untrusted-mail-input"]
published_at: "2026-10-28T18:17:13+00:00"
first_seen_at: "2026-10-28T18:34:33+00:00"
updated_at: "2026-10-28T18:35:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116267", "first_seen_at": "2026-10-28T18:34:33+00:00"}]
---

# Perl MIME::Parser: truncated deep nesting exhausts memory when parsing mail

MIME::Parser before 5.521 stores an error message at every nesting level of a truncated, deeply nested email, and each message is indented further than the last, so stored diagnostics grow with the square of the nesting depth. An attacker who sends such a message can exhaust the memory of the process parsing it, causing a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MIME::Parser version with `perl -MMIME::Parser -e 'print $MIME::Parser::VERSION'`
- Look for code that calls MIME::Parser on untrusted mail and whether a nesting depth limit is set (unknown if the sources give the option name)

## Fix

- Upgrade MIME::Parser to `5.521` or later
- Until upgraded, limit the size or nesting depth of messages passed to the parser (unknown if the sources give a specific setting)

## Timeline

- 2026-10-28T18:34:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116267

## From the sources

MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message.

Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_