The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has.
Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Upgrade to MIME-tools 5.521 or later.
Workaround
No workaround given by the vendor.
| Link | Providers |
|---|---|
| https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes |
|
Wed, 28 Oct 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion. The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has. Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit. | |
| Title | MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion | |
| Weaknesses | CWE-1188 CWE-770 |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-28T17:34:44.660Z
Reserved: 2026-10-25T18:05:02.236Z
Link: CVE-2026-116273
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-28T18:17:13.797
Modified: 2026-10-28T18:17:13.797
Link: CVE-2026-116273
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-28T18:45:07Z