Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116267— MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message

Quick assessment

Affected
CVE-2026-116267
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 语言中，MIME::Parser 5.521 之前的版本存在内存耗尽漏洞。攻击者可利用截断且深度嵌套的消息，通过缩进的错误消息触发该漏洞。 该解析器会为每条存储的诊断信息，按嵌套层级每级缩进三个空格。当一条嵌套深度为 N 的消息在缺少闭合边界的情况下结束时，每一层级都会在各自的深度记录一条错误，导致存储的诊断信息数量随 N 的平方增长。而默认配置并未对嵌套深度设置任何限制。

AI Predicted 7.5 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 5.521 affected

I. Basic Information for CVE-2026-116267

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message
Source: CVE Program / CVE List V5
Vulnerability Description
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 5.521 -

II. Public POCs for CVE-2026-116267

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116267

请登录查看更多情报信息。

Other References for CVE-2026-116267 (1)

IV. Related Vulnerabilities

Same weakness: CWE-407