Answer in brief
CVE-2026-116273 records a Unknown severity vulnerability in MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion. The current sources do not mark it as known exploited. The current feed maps MIME-tools (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps MIME-tools (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| MIME-toolsgeneric | >=0 <5.521 | 5.521 |
Published upstream
Oct 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 28, 2026
MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion. The max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has. Version 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.
Quoted source text, attributed separately from HOL analysis.