---
id: CVE-2026-116270
title: >-
  MIME::Words versions before 5.521 for Perl allow memory exhaustion via
  repeated "=?" sequences in decode_mimewords
summary: >-
  MIME::Words versions before 5.521 for Perl allow memory exhaustion via
  repeated "=?" sequences in decode_mimewords.


  For each "=?" that does not start a complete encoded word, decode_mimewords
  appends an error message containing the whol…
severity: none
cwe:
  - CWE-407
product: MIME-tools
affected:
  - MIME-tools < 5.521
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:33:48.187Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116270'
references:
  - url: 'https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes'
tags:
  - cve.org
ingestedAt: '2026-10-28T18:15:46.381Z'
epss: 0.00177
epssPercentile: 0.07319
---

## Overview

MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords.

For each "=?" that does not start a complete encoded word, decode_mimewords appends an error message containing the whole input string to $@. A boundary of 8,000 "=?" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB.

From version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header.

## Affected

- `MIME-tools < 5.521`

## Remediation

Upgrade to MIME-tools 5.521 or later.