MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.521
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
MIME::Parser for Perl, in versions before 5.521, places no default limit on how many message parts it processes, so a malicious email with a very large number of parts can exhaust memory on the system parsing it. Version 5.521 applies default limits to part count and nesting depth, though these can still be disabled by configuration.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion. The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has. Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- MIME-tools
fixed in 5.521