Vulnerability · Published Oct 28, 2026 · Assigned by CPANSec
CVE-2026-116267MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message
High 7.5
In plain English
A high-severity security flaw in MIME-tools. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libmime-tools-perl | no fix listed | DEBIAN-CVE-2026-116267 |
| Debian:13 | libmime-tools-perl | no fix listed | DEBIAN-CVE-2026-116267 |
| Debian:14 | libmime-tools-perl | 5.522-1 | DEBIAN-CVE-2026-116267 |
| Ubuntu:22.04:LTS | libmime-tools-perl | no fix listed | UBUNTU-CVE-2026-116267 |
| Ubuntu:24.04:LTS | libmime-tools-perl | no fix listed | UBUNTU-CVE-2026-116267 |
| Ubuntu:26.04:LTS | libmime-tools-perl | no fix listed | UBUNTU-CVE-2026-116267 |
| Ubuntu:26.10 | libmime-tools-perl | no fix listed | UBUNTU-CVE-2026-116267 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MIME-tools | 0 – before 5.521 |
Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H