MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion
Impact
MIME::Parser versions before 5.521 for Perl have no default limit on message parts, allowing memory exhaustion. The max_parts option defaults to -1, removing the limit. Version 5.521 sets default limits.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
Upgrade to MIME-tools 5.521 or later.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Vendor not supplied · CPANSec
MIME-tools
1 range
Vendor not supplied · CPANSec
MIME-tools
Package identity
pkg:cpan/MIME-toolsIdentity supplied by CPANSec. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 5.521
custom versions
Other versions: unaffected
Original source description
MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion.
The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has.
Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-116273View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.