CVE-2026-116267: MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message
CVE-2026-116267 key facts
- CISA KEV
- Not listed (catalogue checked )
- Highest advisory rating
- High
- CVSS base score
- 7.5 (Red Hat)
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H· base score 7.5, scored by CISA-ADPAttack vector: network. Attack complexity: low. Privileges required: none. User interaction: none. Scope: unchanged. Confidentiality impact: none. Integrity impact: none. Availability impact: high.- Weakness
- CWE-407 Inefficient Algorithmic Complexity
- CISA SSVC
- Exploitation: none observed. Automatable: yes. Technical impact: partial. CISA, .
- Assigned by
- CPANSec (CNA)
- CVE record published
- Listed by VulniPulse
- Record changed
Ratings, versions and fixes are quoted from the vendor advisories that cover only CVE-2026-116267; each belongs to its advisory, not to every product listed. How records are collected and checked.
Description
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.
Text from the CVE.org record (CPANSec).
How do I fix CVE-2026-116267?
- Upgrade to MIME-tools 5.521 or later. (CVE.org record)
Vendor advisories for CVE-2026-116267
Proxmox
1 advisory- Advisory severityUnrated
Advisory [CVE-2026-116264 +9] Proxmox Mail Gateway: Several issues in libmime-tools-perl
PSA-2026-00091Source published
This bulletin covers 10 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
The MIME::Tools package is used for parsing mails in Proxmox Mail Gateway. Recently two new releases for MIME::Tools were released upstream, fixing several issues, including 10, which were assigned CVE identifiers. The issues can result in bypassing certain mail-filter rules similar to issues PSA-2026-00005-1 and PSA-2026-00049-1. Additionally parsing certain messages could result in spending an excessive amount of CPU time by pmg-smtp-filter. PMG used the Max files setting of the Virus detector as general limit on the maximal number of parts in a mail since at least version 5.0. This effectively limited the effect of the unlimited CPU time. The fixes for the issues were backported and are available in version 5.515-1+pmg3 of libmime-tools-perl. Additionally a hard-coded limit on the…
- Affected products in this advisory
- Proxmox Mail Gateway
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- libmime-tools-perl 5.515-1+pmg3
- pmg-api 9.1.5
- Mitigation guidance
- Update to the fixed package versions: libmime-tools-perl >= 5.515-1+pmg3, pmg-api >= 9.1.5.
Red Hat
1 advisory- Advisory severityHigh7.5
High [CVE-2026-116267] Denial of Service via memory exhaustion from deeply nested messages
CVE-2026-116267Source published Source updated
Denial of Service via memory exhaustion from deeply nested messages. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat package: perl-mime-tools.
- Related products — impact not confirmed
- Red Hat Enterprise Linux 6
- Red Hat package: perl-mime-tools
- Source-reported affected versions
- < 5.521
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
References
Timeline
- CVE record published
- First vendor advisory listed by VulniPulse
- CVE record last updated
More Proxmox advisories
PSA-2026-00090Nov 10, 2026Proxmox Mail Gateway: XSS in content-type display in quarantine viewsPSA-2026-00089Nov 10, 2026Proxmox: Several issues in libpve-http-server-perlPSA-2026-00065Oct 7, 2026Proxmox Mail Gateway: Bypass DMARC check by spoofed envelope sender headerPSA-2026-00064Oct 7, 2026Proxmox Mail Gateway: Administrator to root privilege escalationPSA-2026-00063Oct 7, 2026Proxmox Mail Gateway: Administrator to root privilege escalationPSA-2026-00099Nov 10, 2026Proxmox: Incomplete validation of UPID when handling "stop task" API requests
Get an email when Proxmox publishes the next one.
See Proxmox's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Get alerts for new CVEs on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
