Important: perl-MIME-tools

Issue Overview: MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing...

Important: perl-MIME-tools

Issue Overview: MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit...

CVE-2026-66730-Infinite-Loop-DoS-in-facil.io-MIME-Parser

Security Advisory: Infinite Loop DoS in facil.io MIME Parser Partial Boundary Assigned CVE ID : CVE-2026-66730 Product: facil.io Affected versions: facil.io = 0.6.0 all 0.6.x, all 0.7.x, master; introduced alongside the MIME parser in 0.6.0 Component: lib/facil/http/http.c,...

CVE-2026-66729-Out-of-Bounds-Read-in-facil.io-MIME-Parser-leads-to-Server-Crash

Security Disclosure: Out-of-Bounds Read in facil.io MIME Parser leads to Server crash Assigned CVE ID CVE-2026-66729 Product: facil.io Affected versions: facil.io = 0.6.0 all 0.6.x, all 0.7.x, master; introduced when the MIME parser was added in 0.6.0 Component:...

CVE-2026-121946

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such a...

EUVD-2026-116903

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such a...

CVE-2026-121946 zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such a...

CVE-2026-121946 zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such a...

CVE-2026-121946

The zbateson mail-mime-parser library is vulnerable to a CRLF header injection vulnerability in versions before 3.0.9 and 4.x before 4.0.6 . The root cause is that message-building helpers fail to strip CR and LF characters from input. An attacker providing crafted values for MIME type , charset ...

PT-2026-136966

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such a...

CVE-2026-121946: zbateson mail-mime-parser: zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in…

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such a...

CVE-2026-116267

A flaw was found in MIME::Parser. A remote attacker can cause a Denial of Service DoS by supplying a truncated, deeply nested message without closing boundaries. Because the parser records indented error messages for each nesting level without enforcing depth limits, processing such input leads t...

SUSE CVE-2026-116265

MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections boundary0=, boundary1= and so on is joined after...

SUSE CVE-2026-116267

MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every leve...

SUSE CVE-2026-116271

MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes. Each message is written to a directory named msg--- under the output base, and an existing directory of that name is used as is. A...

SUSE CVE-2026-116272

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written boundaryc="A" or boundary="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a...

SUSE CVE-2026-116273

MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion. The maxparts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has...

DEBIAN-CVE-2026-116267

MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every leve...

DEBIAN-CVE-2026-116271

MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes. Each message is written to a directory named msg--- under the output base, and an existing directory of that name is used as is. A...

CVE-2026-116272

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written boundaryc="A" or boundary="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a...