Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116270— MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords

Quick assessment

Affected
CVE-2026-116270
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 MIME::Words 模块在 5.521 版本之前存在内存耗尽漏洞：当 函数处理包含重复 "=?" 序列的输入时，攻击者可利用该特性耗尽系统内存。 具体而言，对于每个未能构成完整编码单词的 "=?" 序列， 会将包含整个输入字符串的错误消息追加到 Perl 的错误变量 中。若输入中包含 8,000 对 "=?"（共 16,000 字节），则 中将累积约 8,000 份该字符串的副本，占用约 128 MB 内存。 自 5.518 版本起，MIME::Parser 模块在解析 multipart 边界时

AI Predicted 7.5 Difficulty: Trivial

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 5.521 affected

I. Basic Information for CVE-2026-116270

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords
Source: CVE Program / CVE List V5
Vulnerability Description
MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords. For each "=?" that does not start a complete encoded word, decode_mimewords appends an error message containing the whole input string to $@. A boundary of 8,000 "=?" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB. From version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 5.521 -

II. Public POCs for CVE-2026-116270

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116270

请登录查看更多情报信息。

Other References for CVE-2026-116270 (1)

IV. Related Vulnerabilities

Same weakness: CWE-407