MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords.
For each "=?" that does not start a complete encoded word, decode_mimewords appends an error message containing the whole input string to $@. A boundary of 8,000 "=?" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB.
From version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header.
GHSA-jq2x-c3x3-gv8c
MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in...
https://github.com/advisories/GHSA-jq2x-c3x3-gv8cMIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords.
For each "=?" that does not start a complete encoded word, decode_mimewords appends an error message containing the whole input string to $@. A boundary of 8,000 "=?" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB.
From version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header.
Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116270",
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"dateUpdated": "2026-10-28T17:33:48.187Z",
"dateReserved": "2026-10-25T18:05:02.236Z",
"datePublished": "2026-10-28T17:33:48.187Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec",
"dateUpdated": "2026-10-28T17:33:48.187Z"
},
"title": "MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated \"=?\" sequences in decode_mimewords",
"descriptions": [
{
"lang": "en",
"value": "MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated \"=?\" sequences in decode_mimewords.\n\nFor each \"=?\" that does not start a complete encoded word, decode_mimewords appends an error message containing the whole input string to $@. A boundary of 8,000 \"=?\" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB.\n\nFrom version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header."
}
],
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"packageName": "MIME-tools",
"modules": [
"MIME::Words"
],
"programFiles": [
"lib/MIME/Words.pm",
"lib/MIME/Head.pm"
],
"programRoutines": [
{
"name": "MIME::Words::decode_mimewords"
},
{
"name": "MIME::Head::multipart_boundary"
}
],
"repo": "https://salsa.debian.org/dskoll/mime-tools",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "5.521"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-407 Inefficient Algorithmic Complexity",
"cweId": "CWE-407",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes",
"tags": [
"release-notes"
]
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to MIME-tools 5.521 or later."
}
]
}
}
}