{"id":"CVE-2026-116273","kind":"vulnerability","aliases":["CVE-2026-116273"],"related":[],"title":"Perl MIME::Parser: no default part limit lets crafted email exhaust memory","description":"MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion.\n\nThe max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has.\n\nVersion 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.","summary":"MIME::Parser for Perl before 5.521 has no default cap on how many message parts it parses, because max_parts defaults to -1. A crafted multipart email can make a default-configured parser build an entity for every part until memory runs out.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mail-processing","package","perl","self-hosted"],"not_affected_if":["explicit-max-parts-limit","no-untrusted-mime-input","version-5.521-or-later"],"how_to_check":"- Run `perl -MMIME::Parser -e 'print $MIME::Parser::VERSION'` or `cpanm --info MIME::Parser` to read the installed version.\n- Search your code for `MIME::Parser->new` calls that do not set `max_parts`, since the default is unlimited.","fix":"- Upgrade MIME::Parser to `5.521` or later, which sets `max_parts` to `1000` and `max_depth` to `64` by default.\n- Do not set `max_parts` or `max_depth` to `-1` on parsers that handle untrusted mail.","status":"open","published_at":"2026-10-28T18:17:13+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:35:22+00:00","updated_at":"2026-10-28T18:35:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T18:35:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MIME::Parser to `5.521` or later, which sets `max_parts` to `1000` and `max_depth` to `64` by default.\n- Do not set `max_parts` or `max_depth` to `-1` on parsers that handle untrusted mail.","reach":"unknown","title":"Perl MIME::Parser: no default part limit lets crafted email exhaust memory","impact":"low","summary":"MIME::Parser for Perl before 5.521 has no default cap on how many message parts it parses, because max_parts defaults to -1. A crafted multipart email can make a default-configured parser build an entity for every part until memory runs out.","category":"package","nicknames":[],"who_cares":["perl","mail-processing","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Crafted message exhausts memory, crashing the parsing process or service","analyst_note":"","how_to_check":"- Run `perl -MMIME::Parser -e 'print $MIME::Parser::VERSION'` or `cpanm --info MIME::Parser` to read the installed version.\n- Search your code for `MIME::Parser->new` calls that do not set `max_parts`, since the default is unlimited.","needs_analyst":false,"not_affected_if":["version-5.521-or-later","explicit-max-parts-limit","no-untrusted-mime-input"],"who_is_affected":"Applications that use MIME::Parser with default settings to parse email or MIME data from untrusted sources are exposed, because any message can create an unbounded number of parts. Systems that only parse trusted, internally generated MIME, or that already set max_parts to a finite value, are less exposed. Teams not using MIME::Parser can skip it.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":3346,"output_tokens":630,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1':49B,97C,137C '-116273':15A,18A '-2026':14A,17A '1000':126C '5.521':32B,74C,121C '64':131C 'allow':88C 'build':61B,109C 'cap':36B 'configur':59B 'craft':9A,51B 'creat':105C 'cve':13A,16A 'default':5A,35B,47B,58B,87C,95C,107C,133C 'default-configur':57B 'depth':129C 'disabl':99C 'either':135C 'email':10A,53B 'entiti':63B,111C 'everi':65B,113C 'exhaust':11A,90C 'host':26B 'howev':115C 'let':8A 'limit':7A,79C,101C,141C 'mail':20B 'mail-process':19B 'make':55B 'mani':39B,116C 'max':45B,92C,123C,128C 'memori':12A,68B,89C 'messag':40B,84C,118C 'mime':2A,27B,70C 'multipart':52B 'number':82C 'option':94C 'packag':22B 'pars':43B 'parser':3A,28B,60B,71C,104C 'part':6A,41B,46B,66B,85C,93C,114C,124C 'perl':1A,23B,30B,76C 'process':21B 'remov':139C 'run':69B 'self':25B 'self-host':24B 'set':77C,108C,122C,134C 'still':138C 'version':72C,120C","nicknames":[],"mitigations":[],"who_affected":"Applications that use MIME::Parser with default settings to parse email or MIME data from untrusted sources are exposed, because any message can create an unbounded number of parts. Systems that only parse trusted, internally generated MIME, or that already set max_parts to a finite value, are less exposed. Teams not using MIME::Parser can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116273","severity":null,"published_at":"2026-10-28T18:17:13+00:00","modified_at":"2026-10-28T18:17:13+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}