Live › vulnerability › CVE-2026-116273
Go to dashboardMIME::Parser for Perl before 5.521 has no default cap on how many message parts it parses, because max_parts defaults to -1. A crafted multipart email can make a default-configured parser build an entity for every part until memory runs out.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Applications that use MIME::Parser with default settings to parse email or MIME data from untrusted sources are exposed, because any message can create an unbounded number of parts. Systems that only parse trusted, internally generated MIME, or that already set max_parts to a finite value, are less exposed. Teams not using MIME::Parser can skip it.
No product ranges from the sources yet.
perl -MMIME::Parser -e 'print $MIME::Parser::VERSION' or cpanm --info MIME::Parser to read the installed version.MIME::Parser->new calls that do not set max_parts, since the default is unlimited.5.521 or later, which sets max_parts to 1000 and max_depth to 64 by default.max_parts or max_depth to -1 on parsers that handle untrusted mail.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion.
The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has.
Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.
This page as .md · .json · in your agent: get_signal("CVE-2026-116273")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.