{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-116273 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-116273 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-116273 is a vulnerability, published on 28 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-116273 and fix it if it is affected.\n\nWhat it is: CVE-2026-116273 is a vulnerability, published on 28 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-116273 in the wild and no public exploit code.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-116273/ (Markdown: https://insights.sbomify.com/CVE-2026-116273/index.md)","id":"CVE-2026-116273","markdown":"https://insights.sbomify.com/CVE-2026-116273/index.md","name":"CVE-2026-116273","record":{"aliases":["DEBIAN-CVE-2026-116273","GHSA-xrpv-r4cr-x2x4","UBUNTU-CVE-2026-116273"],"analysis":null,"analysis_generated_by":null,"assigner":"CPANSec","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"},{"id":"CWE-1188","name":"Initialization of a Resource with an Insecure Default"}],"description":"MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion.\n\nThe max_parts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has.\n\nVersion 5.521 sets max_parts to 1000 and max_depth to 64 by default. Setting either to -1 still removes the limit.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion.","id":"CVE-2026-116273","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"JIZHICMS Front-end Order OrderController.php pay improper authorization","id":"CVE-2026-116274"},"packages":[],"prev":{"headline":"MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.","id":"CVE-2026-116272"},"products":[],"published":"2026-10-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-28","vendors":[]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-116273/"}