CVE-2026-116273
CVE-2026-116273 · MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion
This page contains facts from public vulnerability sources. Check the original advisory before updating.
MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion. The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has. Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.
EPSS 0.2%
- Published
- Updated
Stack: system
Affected products and versions
libmime-tools-perl Debian:12
- Versions
- 5.510-1
- 5.510-2
- 5.510-3
- 5.512-1
- 5.513-1
- 5.514-1
- 5.515-1
- 5.517-1
- 5.518-1
- 5.519-1
- 5.520-1
- 5.522-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Debian:13
- Versions
- 5.515-1
- 5.517-1
- 5.518-1
- 5.519-1
- 5.520-1
- 5.522-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Debian:14
- Versions
- 5.515-1
- 5.517-1
- 5.518-1
- 5.519-1
- 5.520-1
- 5.522-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:14.04:LTS
- Versions
- 5.503-1
- 5.504-1
- 5.505-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:16.04:LTS
- Versions
- 5.505-1
- 5.507-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:18.04:LTS
- Versions
- 5.508-1
- 5.509-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:20.04:LTS
- Versions
- 5.509-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:22.04:LTS
- Versions
- 5.509-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:24.04:LTS
- Versions
- 5.510-3
- 5.512-1
- 5.513-1
- 5.514-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:26.10
- Versions
- 5.517-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libmime-tools-perl Ubuntu:26.04:LTS
- Versions
- 5.515-1
- 5.517-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published