{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-116270 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-116270 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-116270 is a vulnerability, published on 28 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-116270 and fix it if it is affected.\n\nWhat it is: CVE-2026-116270 is a vulnerability, published on 28 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-116270 in the wild and no public exploit code.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-116270/ (Markdown: https://insights.sbomify.com/CVE-2026-116270/index.md)","id":"CVE-2026-116270","markdown":"https://insights.sbomify.com/CVE-2026-116270/index.md","name":"CVE-2026-116270","record":{"aliases":["DEBIAN-CVE-2026-116270","GHSA-jq2x-c3x3-gv8c","UBUNTU-CVE-2026-116270"],"analysis":null,"analysis_generated_by":null,"assigner":"CPANSec","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[{"id":"CWE-407","name":"Inefficient Algorithmic Complexity"}],"description":"MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated \"=?\" sequences in decode_mimewords.\n\nFor each \"=?\" that does not start a complete encoded word, decode_mimewords appends an error message containing the whole input string to $@. A boundary of 8,000 \"=?\" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB.\n\nFrom version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated \"=?\" sequences in decode_mimewords","id":"CVE-2026-116270","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users r","id":"CVE-2026-116271"},"packages":[],"prev":{"headline":"MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename.","id":"CVE-2026-116269"},"products":[],"published":"2026-10-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-28","vendors":[]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-116270/"}