Uncontrolled Resource Consumption in zbateson/mail-mime-parser Affecting Applications
CVE-2026-61816
What is CVE-2026-61816?
The zbateson/mail-mime-parser library, which serves as an alternative to PHP's imap functions and Pear libraries, is impacted by an uncontrolled resource consumption vulnerability. This issue primarily affects applications parsing untrusted email messages using versions 2.0.0 to 3.0.5 and 4.0.0 to 4.0.1. Attackers can exploit super-linear parsing costs, leading to high CPU usage and excessive memory consumption. As crafted email messages under 2 MB can trigger significant resource exhaustion, this presents a risk of denial of service. Users should upgrade to either versions 3.0.6 or 4.0.2, which introduce configurable limits to mitigate this vulnerability. Until a proper upgrade can be performed, it is recommended to leverage restricted confines on memory limit and execution time to prevent resource exhaustion from malicious input.
Affected Version(s)
mail-mime-parser >= 2.0.0, < 3.0.6 < 2.0.0, 3.0.6
mail-mime-parser >= 4.0.0, < 4.0.2 < 4.0.0, 4.0.2