MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion.
The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has.
Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.
< 5.521 - AFFECTED
MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by...
https://github.com/advisories/GHSA-xrpv-r4cr-x2x4MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion.
The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has.
Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116273",
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"dateUpdated": "2026-10-28T17:34:44.660Z",
"dateReserved": "2026-10-25T18:05:02.236Z",
"datePublished": "2026-10-28T17:34:44.660Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec",
"dateUpdated": "2026-10-28T17:34:44.660Z"
},
"title": "MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion",
"descriptions": [
{
"lang": "en",
"value": "MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion.\n\nThe max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has.\n\nVersion 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit."
}
],
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"packageName": "MIME-tools",
"modules": [
"MIME::Parser"
],
"programFiles": [
"lib/MIME/Parser.pm"
],
"programRoutines": [
{
"name": "MIME::Parser::init"
},
{
"name": "MIME::Parser::process_part"
}
],
"repo": "https://salsa.debian.org/dskoll/mime-tools",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "5.521"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-1188 Initialization of a Resource with an Insecure Default",
"cweId": "CWE-1188",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"cweId": "CWE-770",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes",
"tags": [
"release-notes"
]
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to MIME-tools 5.521 or later."
}
]
}
}
}