Skip to content
Heist/ feed
HighFix available

zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME

Type: advisorySource: OSV1 source record

### Impact An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library. Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does **not** bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first `getAllParts()` or content read. ### Details 1. **Deep multipart nesting is O(depth²).** `MimeParserService::findContentBoundary()` tests each content line against the current part and every ancestor via the recursive `ParserMimePartProxy::setEndBoundaryFound()`, so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute. 2. **Many sibling parts is O(n²).** `PartChildrenContainer::add()` appends each child with `array_splice($children, count($children), 0, [$part])`, which reindexes the entire array on every call. The same container backs UUEncoded `begin` parts via `NonMimeParserService`. 3. **Header buffering is unbounded.** `HeaderParserService::parse()` reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed. ### Proo

Announced Group revision 1
Original source ↗

GHSA-f6v3-2qmr-vfjx

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-f6v3-2qmr-vfjx

zbateson/mail-mime-parser

Source reference: /affected/0/package/name

Affected versions
2.0.0

Source reference: /affected/0/versions

2.0.1

Source reference: /affected/0/versions

2.1.0

Source reference: /affected/0/versions

2.1.1

Source reference: /affected/0/versions

2.2.0

Source reference: /affected/0/versions

2.2.1

Source reference: /affected/0/versions

2.2.2

Source reference: /affected/0/versions

2.2.3

Source reference: /affected/0/versions

2.3.0

Source reference: /affected/0/versions

2.4.0

Source reference: /affected/0/versions

2.4.1

Source reference: /affected/0/versions

3.0.0

Source reference: /affected/0/versions

3.0.0-beta

Source reference: /affected/0/versions

3.0.0-beta.2

Source reference: /affected/0/versions

3.0.1

Source reference: /affected/0/versions

3.0.2

Source reference: /affected/0/versions

3.0.3

Source reference: /affected/0/versions

3.0.4

Source reference: /affected/0/versions

3.0.5

Source reference: /affected/0/versions

Fixed versions
3.0.6

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

zbateson/mail-mime-parser

Source reference: /affected/1/package/name

Affected versions
4.0.0

Source reference: /affected/1/versions

4.0.1

Source reference: /affected/1/versions

Fixed versions
4.0.2

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "2.0.0"
          },
          {
            "fixed": "3.0.6"
          }
        ]
      }
    ],
    "package": {
      "name": "zbateson/mail-mime-parser",
      "purl": "pkg:composer/zbateson/mail-mime-parser",
      "ecosystem": "Packagist"
    },
    "versions": [
      "2.0.0",
      "2.0.1",
      "2.1.0",
      "2.1.1",
      "2.2.0",
      "2.2.1",
      "2.2.2",
      "2.2.3",
      "2.3.0",
      "2.4.0",
      "2.4.1",
      "3.0.0",
      "3.0.0-beta",
      "3.0.0-beta.2",
      "3.0.1",
      "3.0.2",
      "3.0.3",
      "3.0.4",
      "3.0.5"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-f6v3-2qmr-vfjx/GHSA-f6v3-2qmr-vfjx.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "4.0.0"
          },
          {
            "fixed": "4.0.2"
          }
        ]
      }
    ],
    "package": {
      "name": "zbateson/mail-mime-parser",
      "purl": "pkg:composer/zbateson/mail-mime-parser",
      "ecosystem": "Packagist"
    },
    "versions": [
      "4.0.0",
      "4.0.1"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-f6v3-2qmr-vfjx/GHSA-f6v3-2qmr-vfjx.json"
    }
  }
]
Related CVEs
CVE-2026-61816

Source reference: /aliases

Publisher severity

high

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-61816 · High

mail-mime-parser

Event
#14233 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement