CVE-2026-116270: fallo de gravedad alta en MIME-tools
MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.2%
MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords.
For each "=?" that does not start a complete encoded word, decode_mimewords appends an error message containing the whole input string to $@. A boundary of 8,000 "=?" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB.
From version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
MIME-toolsCVEs relacionadas — MIME-tools
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-116271HIGHMIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writesEPSS 0.2%CVE-2026-116273HIGHMIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustionEPSS 0.2%CVE-2026-116272MEDIUMMIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested commentEPSS 0.2%CVE-2026-116269MEDIUMMIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filenameEPSS 0.2%CVE-2026-116268HIGHMIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parametersEPSS 0.2%CVE-2026-116267HIGHMIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested messageEPSS 0.2%