The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has.
Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to MIME-tools 5.521 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes |
|
Wed, 28 Oct 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion. The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has. Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit. | |
| Title | MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion | |
| Weaknesses | CWE-1188 CWE-770 |
|
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-28T17:34:44.660Z
Reserved: 2026-10-25T18:05:02.236Z
Link: CVE-2026-116273
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-28T18:17:13.797
Modified: 2026-10-28T18:17:13.797
Link: CVE-2026-116273
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-28T18:45:07Z