CVE-2026-116267: falha de alta gravidade em MIME-tools
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.3%
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message.
Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
MIME-toolsCVEs relacionadas — MIME-tools
No mesmo produto, das mais perigosas para as menos.
CVE-2026-116273HIGHMIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustionEPSS 0.3%CVE-2026-116270HIGHMIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewordsEPSS 0.3%CVE-2026-116268HIGHMIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parametersEPSS 0.3%CVE-2026-116272MEDIUMMIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested commentEPSS 0.2%CVE-2026-116269MEDIUMMIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filenameEPSS 0.2%CVE-2026-116266MEDIUMMIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguousEPSS 0.2%