CVE-2026-116267
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages…
- Risk score
- 52/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its…
- Affected
- See advisory
- Fix
- Upgrade the product to 5.521 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.
Last activity 28 Oct 2026. Patch Forecast updates every hour.