{"answers":{"affected":"4 open source packages ship an affected version, including zbateson/mail-mime-parser.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61816 exists.","fix":"Upgrade zbateson/mail-mime-parser to a fixed version for your release line: 3.0.6 or 4.0.2.","what":"CVE-2026-61816 is a high-severity denial of service vulnerability in zbateson mail-mime-parser, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-61816 and fix it if it is affected.\n\nWhat it is: CVE-2026-61816 is a high-severity denial of service vulnerability in zbateson mail-mime-parser, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61816 exists.\n\nAffected packages and fixed versions:\n- zbateson/mail-mime-parser (Packagist): affected from 2.0.0; fixed in 3.0.6\n- zbateson/mail-mime-parser (Packagist): affected from 2.0.0; fixed in 3.0.6\n- zbateson/mail-mime-parser (Packagist): affected from 4.0.0; fixed in 4.0.2\n- zbateson/mail-mime-parser (Packagist): affected from 4.0.0; fixed in 4.0.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-61816/ (Markdown: https://insights.sbomify.com/CVE-2026-61816/index.md)","id":"CVE-2026-61816","markdown":"https://insights.sbomify.com/CVE-2026-61816/index.md","name":"CVE-2026-61816","record":{"aliases":["GHSA-f6v3-2qmr-vfjx"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"PHP mail parsing library","requires_auth":"none","summary":"Attackers can cause denial of service via resource exhaustion by sending crafted MIME messages to applications using this PHP library.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"description":"zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Starting in version 2.0.0 and prior to version 3.0.6 and 4.0.2, an uncontrolled resource consumption / algorithmic complexity vulnerability (CWE-400) affects any application that parses untrusted email with this library. Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does **not** bound the work done.  A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first `getAllParts()` or content read. This is fxed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions. Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.) These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME","id":"CVE-2026-61816","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":4,"n_references":1,"next":{"headline":"pg_partman privilege escalation via SQL injection in several functions via time decoder","id":"CVE-2026-61817"},"packages":[{"ecosystem":"Packagist","fixed":["3.0.6"],"introduced":["2.0.0"],"last_affected":[],"package":"zbateson/mail-mime-parser","purl":null,"source":"GHSA-f6v3-2qmr-vfjx"},{"ecosystem":"Packagist","fixed":["3.0.6"],"introduced":["2.0.0"],"last_affected":[],"package":"zbateson/mail-mime-parser","purl":"pkg:composer/zbateson/mail-mime-parser","source":"GHSA-f6v3-2qmr-vfjx"},{"ecosystem":"Packagist","fixed":["4.0.2"],"introduced":["4.0.0"],"last_affected":[],"package":"zbateson/mail-mime-parser","purl":null,"source":"GHSA-f6v3-2qmr-vfjx"},{"ecosystem":"Packagist","fixed":["4.0.2"],"introduced":["4.0.0"],"last_affected":[],"package":"zbateson/mail-mime-parser","purl":"pkg:composer/zbateson/mail-mime-parser","source":"GHSA-f6v3-2qmr-vfjx"}],"prev":{"headline":"zbateson/mail-mime-parser has CRLF header injection via attachment filename","id":"CVE-2026-61815"},"products":["mail-mime-parser"],"published":"2026-09-24","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-24","vendors":["zbateson"]},"summary":"Attackers can cause denial of service via resource exhaustion by sending crafted MIME messages to applications using this PHP library.","url":"https://insights.sbomify.com/CVE-2026-61816/"}