CVE-2026-61816
Received Received - Intake

Uncontrolled Resource Consumption in zbateson/mail-mime-parser

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Starting in version 2.0.0 and prior to version 3.0.6 and 4.0.2, an uncontrolled resource consumption / algorithmic complexity vulnerability (CWE-400) affects any application that parses untrusted email with this library. Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does **not** bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first `getAllParts()` or content read. This is fxed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions. Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.) These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-61816
EUVD
EUVD-2026-86336

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
zbateson mail_mime_parser to 3.0.6 (exc)
zbateson mail_mime_parser to 3.0.6 (inc)
zbateson mail_mime_parser to 4.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an uncontrolled resource consumption issue in the zbateson/mail-mime-parser library. It affects versions 2.0.0 to 3.0.5 and 4.0.0 to 4.0.1. The problem occurs when parsing untrusted email messages, where three parsing paths have super-linear computational complexity. A crafted message under 2 MB can cause excessive CPU usage or memory consumption, potentially leading to system crashes or denial of service.

Detection Guidance

Detecting this vulnerability requires checking the version of zbateson/mail-mime-parser in use. If your application uses versions 2.0.0 to 3.0.5 or 4.0.0 to 4.0.1, it is vulnerable. Run commands like 'composer show zbateson/mail-mime-parser' or check your dependency files for the installed version.

Impact Analysis

If you use the affected versions of this library to parse untrusted email messages, an attacker could send a specially crafted email that consumes excessive system resources. This may result in slow performance, system crashes, or denial of service for your application or server. The vulnerability is triggered when the email is first parsed, such as when calling getAllParts() or reading content.

Mitigation Strategies

Immediately upgrade to version 3.0.6, 4.0.2, or later. If using version 2.x, upgrade to a fixed release as 2.x is end-of-life. Until upgrading, restrict parser access to untrusted input and enforce memory and execution time limits to prevent DoS.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61816. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart