Memory Exhaustion Vulnerability in Perl's MIME::Parser by DSKOLL

CVE-2026-116273

What is CVE-2026-116273?

The MIME::Parser version before 5.521 for Perl has a serious memory exhaustion vulnerability due to the lack of limits on the number of message parts parsed by default. This flawed configuration allows an attacker to craft a message with an excessive number of parts, leading to potential denial of service by exhausting system memory. In version 5.521, limitations were introduced, setting the max_parts to 1000 and max_depth to 64 to mitigate this issue. However, setting these values to -1 can still remove these limits, which requires configuration diligence.

References