========================================================================
CVE-2026-116267                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-116267

   Distribution:  MIME-tools
       Versions:  before 5.521
       MetaCPAN:  https://metacpan.org/dist/MIME-tools
       VCS Repo:  https://salsa.debian.org/dskoll/mime-tools

MIME::Parser versions before 5.521 for Perl allow memory exhaustion via
indented error messages from a truncated, deeply nested message

Description
-----------
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via
indented error messages from a truncated, deeply nested message.

Each stored parser diagnostic is indented by three spaces per nesting
level. When a message nested N levels deep ends without its closing
boundaries, every level logs an error at its own depth, so the stored
diagnostics grow with the square of N. The defaults place no limit on
nesting depth.

Problem types
-------------
- CWE-407 Inefficient Algorithmic Complexity

Solutions
---------
Upgrade to MIME-tools 5.521 or later.

References
----------
https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes