CVE-2026-116270 MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116270?
CVE-2026-116270 is a vulnerability, published on 28 Oct 2026.
Official description
MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords.
For each "=?" that does not start a complete encoded word, decode_mimewords appends an error message containing the whole input string to $@. A boundary of 8,000 "=?" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB.
From version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header.
Weakness: CWE-407
Which versions are affected by CVE-2026-116270?
How do I fix CVE-2026-116270?
No fix has been published for CVE-2026-116270 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116270 being exploited?
There is no known exploitation of CVE-2026-116270 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-116270, GHSA-jq2x-c3x3-gv8c, UBUNTU-CVE-2026-116270.