---
id: CVE-2026-116273
title: >-
  MIME::Parser versions before 5.521 for Perl set no limit on the number of
  message parts by default, allowing memory exhaustion
summary: >-
  MIME::Parser versions before 5.521 for Perl set no limit on the number of
  message parts by default, allowing memory exhaustion.


  The max_parts option defaulted to -1, which disables the limit, so a parser
  created with default settings bu…
severity: none
cwe:
  - CWE-1188
  - CWE-770
product: MIME-tools
affected:
  - MIME-tools < 5.521
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:34:44.660Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116273'
references:
  - url: 'https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes'
tags:
  - cve.org
ingestedAt: '2026-10-28T18:15:46.380Z'
epss: 0.00177
epssPercentile: 0.07318
---

## Overview

MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion.

The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has.

Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.

## Affected

- `MIME-tools < 5.521`

## Remediation

Upgrade to MIME-tools 5.521 or later.