CVE-2026-116264 +9 CVEs: Proxmox Mail Gateway: Several issues in libmime-tools-perl
This Proxmox advisory covers CVE-2026-116264 and CVE-2026-116265 and 8 more CVEs in Proxmox Mail Gateway. Its rating, versions and guidance apply to the bulletin as a whole, not to each of its 10 CVEs.
- CVE-2026-116264
- CVE-2026-116265
- CVE-2026-116266
- CVE-2026-116267
- CVE-2026-116268
- CVE-2026-116269
- CVE-2026-116270
- CVE-2026-116271
- CVE-2026-116272
- CVE-2026-116273
Key facts
- Fixed in
- libmime-tools-perl 5.515-1+pmg3, pmg-api 9.1.5
- Advisory id
- PSA-2026-00091
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
The MIME::Tools package is used for parsing mails in Proxmox Mail Gateway. Recently two new releases for MIME::Tools were released upstream, fixing several issues, including 10, which were assigned CVE identifiers.
The issues can result in bypassing certain mail-filter rules similar to issues PSA-2026-00005-1 and PSA-2026-00049-1. Additionally parsing certain messages could result in spending an excessive amount of CPU time by pmg-smtp-filter.
PMG used the Max files setting of the Virus detector as general limit on the maximal number of parts in a mail since at least version 5.0. This effectively limited the effect of the unlimited CPU time.
The fixes for the issues were backported and are available in version 5.515-1+pmg3 of libmime-tools-perl. Additionally a hard-coded limit on the nesting level of MIME parts was added as defense-in-depth.
We'd like to thank Dianne Skoll for notifying us about releases and the issues that were fixed. Packages: libmime-tools-perl, pmg-api.
Text from the source record.
Fix and mitigation
Fixed releases named by the bulletin:
- libmime-tools-perl 5.515-1+pmg3
- pmg-api 9.1.5
Vendor guidance
- Update to the fixed package versions: libmime-tools-perl >= 5.515-1+pmg3, pmg-api >= 9.1.5.
Support dates for the fixed release lines
- Proxmox Mail Gateway 5: support ended
More Proxmox advisories
PSA-2026-00090Nov 10, 2026Proxmox Mail Gateway: XSS in content-type display in quarantine viewsPSA-2026-00089Nov 10, 2026Proxmox: Several issues in libpve-http-server-perlPSA-2026-00065Oct 7, 2026Proxmox Mail Gateway: Bypass DMARC check by spoofed envelope sender headerPSA-2026-00064Oct 7, 2026Proxmox Mail Gateway: Administrator to root privilege escalationPSA-2026-00063Oct 7, 2026Proxmox Mail Gateway: Administrator to root privilege escalationPSA-2026-00099Nov 10, 2026Proxmox: Incomplete validation of UPID when handling "stop task" API requests
Get an email when Proxmox Mail Gateway (PMG) publishes the next one.
See Proxmox Mail Gateway (PMG)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Proxmox CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
