Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Perl libmime-tools can run out of memory

CVE-2026-116267 · published 7 days ago
Summary

The libmime-tools package for Perl on Debian and Ubuntu can consume excessive memory when it processes a malformed email with many nested parts. The program logs an error for each nesting level, and without a limit this can quickly exhaust system resources. Update the package to the latest version or apply the vendor’s patch to add a nesting depth limit.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian libmime-tools-perl All versions
Debian:13 debian libmime-tools-perl All versions
Debian:14 debian libmime-tools-perl All versions
Ubuntu:14.04:LTS canonical libmime-tools-perl All versions
Original advisory text
DEBIAN-CVE-2026-116267
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.
References
Exploitation
<1% chance of attack within 30 days
Type
CWE-407Inefficient Algorithmic Complexity
Timeline
Published28 Oct 2026
Updated3 Nov 2026
First seen27 Oct 2026
Sources
DEBIAN-CVE-2026-116267 · OSV
CVE-2026-116267 · NVD
CVE-2026-116267 · MITRE
UBUNTU-CVE-2026-116267 · OSV
Track software like this
Free during beta