---
id: "CVE-2026-116270"
kind: "vulnerability"
aliases: ["CVE-2026-116270"]
title: "Perl MIME::Words: repeated encoded-word markers exhaust memory during mail parsing"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["email-parsing", "mime-tools", "package", "perl"]
not_affected_if: ["no-untrusted-mime-input", "versions-before-5.518"]
published_at: "2026-10-28T18:17:13+00:00"
first_seen_at: "2026-10-28T18:34:33+00:00"
updated_at: "2026-10-28T18:35:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116270", "first_seen_at": "2026-10-28T18:34:33+00:00"}]
---

# Perl MIME::Words: repeated encoded-word markers exhaust memory during mail parsing

MIME::Words before 5.521 appends the whole input string to an error variable for each malformed "=?" marker, so a crafted header multiplies its size. From 5.518 onward MIME::Parser runs this on every multipart boundary, so one Content-Type header from a remote sender can exhaust the parsing process's memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `perl -MMIME::Words -e 'print $MIME::Words::VERSION'` or `cpan -l | grep MIME-Tools` to find the installed MIME::Words version.
- Check for MIME::Parser or MIME-Tools in your dependencies, e.g. `grep -r "MIME::Parser" .` in the application source.

## Fix

- Upgrade MIME::Words to `5.521` or later (distributed with MIME-Tools).
- Until upgraded, limit request or message size before parsing mail.

## Timeline

- 2026-10-28T18:34:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116270

## From the sources

MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords.

For each "=?" that does not start a complete encoded word, decode_mimewords appends an error message containing the whole input string to $@. A boundary of 8,000 "=?" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB.

From version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_