CVE-2026-116273: fallo de gravedad alta en MIME-tools
MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.2%
MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion.
The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has.
Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
MIME-toolsCVEs relacionadas — MIME-tools
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-116271HIGHMIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writesEPSS 0.2%CVE-2026-116272MEDIUMMIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested commentEPSS 0.2%CVE-2026-116270HIGHMIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewordsEPSS 0.2%CVE-2026-116269MEDIUMMIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filenameEPSS 0.2%CVE-2026-116268HIGHMIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parametersEPSS 0.2%CVE-2026-116267HIGHMIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested messageEPSS 0.2%