========================================================================
CVE-2026-116270                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-116270

   Distribution:  MIME-tools
       Versions:  before 5.521
       MetaCPAN:  https://metacpan.org/dist/MIME-tools
       VCS Repo:  https://salsa.debian.org/dskoll/mime-tools

MIME::Words versions before 5.521 for Perl allow memory exhaustion via
repeated "=?" sequences in decode_mimewords

Description
-----------
MIME::Words versions before 5.521 for Perl allow memory exhaustion via
repeated "=?" sequences in decode_mimewords.

For each "=?" that does not start a complete encoded word,
decode_mimewords appends an error message containing the whole input
string to $@. A boundary of 8,000 "=?" pairs (16,000 bytes) adds 8,000
copies of itself to $@, about 128 MB.

 From version 5.518, MIME::Parser decodes every multipart boundary this
way, so a remote sender can exhaust the memory of the parsing process
with one Content-Type header.

Problem types
-------------
- CWE-407 Inefficient Algorithmic Complexity

Solutions
---------
Upgrade to MIME-tools 5.521 or later.

References
----------
https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes