CVE-2026-116267: fallo de gravedad alta en MIME-tools
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.3%
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message.
Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
MIME-toolsCVEs relacionadas — MIME-tools
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-116273HIGHMIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustionEPSS 0.3%CVE-2026-116270HIGHMIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewordsEPSS 0.3%CVE-2026-116268HIGHMIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parametersEPSS 0.3%CVE-2026-116272MEDIUMMIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested commentEPSS 0.2%CVE-2026-116269MEDIUMMIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filenameEPSS 0.2%CVE-2026-116266MEDIUMMIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguousEPSS 0.2%