CVE-2026-116270
CVE-2026-116270 · MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords
This page contains facts from public vulnerability sources. Check the original advisory before updating.
MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords. For each "=?" that does not start a complete encoded word, decode_mimewords appends an error message containing the whole input string to $@. A boundary of 8,000 "=?" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB. From version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header.
EPSS 0.2%
- Published
- Updated
Stack: system
Affected products and versions
libmime-tools-perl Debian:12
- Versions
- 5.510-1
- 5.510-2
- 5.510-3
- 5.512-1
- 5.513-1
- 5.514-1
- 5.515-1
- 5.517-1
- 5.518-1
- 5.519-1
- 5.520-1
- 5.522-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Debian:13
- Versions
- 5.515-1
- 5.517-1
- 5.518-1
- 5.519-1
- 5.520-1
- 5.522-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Debian:14
- Versions
- 5.515-1
- 5.517-1
- 5.518-1
- 5.519-1
- 5.520-1
- 5.522-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:14.04:LTS
- Versions
- 5.503-1
- 5.504-1
- 5.505-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:16.04:LTS
- Versions
- 5.505-1
- 5.507-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:18.04:LTS
- Versions
- 5.508-1
- 5.509-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:20.04:LTS
- Versions
- 5.509-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:22.04:LTS
- Versions
- 5.509-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:24.04:LTS
- Versions
- 5.510-3
- 5.512-1
- 5.513-1
- 5.514-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:26.10
- Versions
- 5.517-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:26.04:LTS
- Versions
- 5.515-1
- 5.517-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published