Description
MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion.
The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has.
Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | MIME-tools | < 5.521 | 5.521 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libmime-tools-perl | 5.522-1 | — |
| Debian 13 | libmime-tools-perl | No fix yet | — |
| Debian 12 | libmime-tools-perl | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libmime-tools-perl | No fix yet | — |
| Ubuntu 26.04 LTS | libmime-tools-perl | No fix yet | — |
| Ubuntu 24.04 LTS | libmime-tools-perl | No fix yet | — |
| Ubuntu 22.04 LTS | libmime-tools-perl | No fix yet | — |
| Ubuntu 20.04 LTS | libmime-tools-perl | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libmime-tools-perl | No fix yet | — |
| Ubuntu 16.04 LTS | libmime-tools-perl | No fix yet | — |
| Ubuntu 14.04 LTS | libmime-tools-perl | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | perl-MIME-tools | 5.522.0-1.1 | openSUSE-SU-2026:12347-1 |
| openSUSE Leap 16.0 | perl-MIME-tools | 5.522.0-bp160.1.1 | openSUSE-SU-2026:22226-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | perl-MIME-tools | 5.522-1.amzn2023.0.1 | ALAS2023-2026-3425 |
| Amazon Linux 2 | perl-MIME-tools | 5.505-1.amzn2.0.1 | ALAS2-2026-4095 |
Advisories 4
- ALAS2023-2026-3425 Important: perl-MIME-tools security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- ALAS2-2026-4095 Important: perl-MIME-tools security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- openSUSE-SU-2026:22226-1 Security update for perl-MIME-tools SUSE / openSUSE Security Updates · Nov 4, 2026
- openSUSE-SU-2026:12347-1 perl-MIME-tools-5.522.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 31, 2026