Memory Exhaustion Vulnerability in MIME::Words for Perl by DSKOLL

CVE-2026-116270

What is CVE-2026-116270?

The MIME::Words module for Perl, prior to version 5.521, is susceptible to memory exhaustion due to how it handles malformed encoded words in the decode_mimewords function. An attacker can exploit this by sending multiple invalid =? sequences within a Content-Type header, drastically increasing memory consumption and potentially leading to application crashes. With each erroneous sequence added, the module aggregates error messages to a variable, ultimately overwhelming the system's memory capacity as it incorrectly processes these sequences.

References