zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME
### Impact An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library. Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does **not** bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first `getAllParts()` or content read. ### Details 1. **Deep multipart nesting is O(depth²).** `MimeParserService::findContentBoundary()` tests each content line against the current part and every ancestor via the recursive `ParserMimePartProxy::setEndBoundaryFound()`, so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute. 2. **Many sibling parts is O(n²).** `PartChildrenContainer::add()` appends each child with `array_splice($children, count($children), 0, [$part])`, which reindexes the entire array on every call. The same container backs UUEncoded `begin` parts via `NonMimeParserService`. 3. **Header buffering is unbounded.** `HeaderParserService::parse()` reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed. ### Proo
GHSA-f6v3-2qmr-vfjx
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-f6v3-2qmr-vfjx
zbateson/mail-mime-parser
Source reference: /affected/0/package/name
- Affected versions
- 2.0.0
Source reference:
/affected/0/versions2.0.1Source reference:
/affected/0/versions2.1.0Source reference:
/affected/0/versions2.1.1Source reference:
/affected/0/versions2.2.0Source reference:
/affected/0/versions2.2.1Source reference:
/affected/0/versions2.2.2Source reference:
/affected/0/versions2.2.3Source reference:
/affected/0/versions2.3.0Source reference:
/affected/0/versions2.4.0Source reference:
/affected/0/versions2.4.1Source reference:
/affected/0/versions3.0.0Source reference:
/affected/0/versions3.0.0-betaSource reference:
/affected/0/versions3.0.0-beta.2Source reference:
/affected/0/versions3.0.1Source reference:
/affected/0/versions3.0.2Source reference:
/affected/0/versions3.0.3Source reference:
/affected/0/versions3.0.4Source reference:
/affected/0/versions3.0.5Source reference:
/affected/0/versions - Fixed versions
- 3.0.6
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
zbateson/mail-mime-parser
Source reference: /affected/1/package/name
- Affected versions
- 4.0.0
Source reference:
/affected/1/versions4.0.1Source reference:
/affected/1/versions - Fixed versions
- 4.0.2
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "3.0.6"
}
]
}
],
"package": {
"name": "zbateson/mail-mime-parser",
"purl": "pkg:composer/zbateson/mail-mime-parser",
"ecosystem": "Packagist"
},
"versions": [
"2.0.0",
"2.0.1",
"2.1.0",
"2.1.1",
"2.2.0",
"2.2.1",
"2.2.2",
"2.2.3",
"2.3.0",
"2.4.0",
"2.4.1",
"3.0.0",
"3.0.0-beta",
"3.0.0-beta.2",
"3.0.1",
"3.0.2",
"3.0.3",
"3.0.4",
"3.0.5"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-f6v3-2qmr-vfjx/GHSA-f6v3-2qmr-vfjx.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.2"
}
]
}
],
"package": {
"name": "zbateson/mail-mime-parser",
"purl": "pkg:composer/zbateson/mail-mime-parser",
"ecosystem": "Packagist"
},
"versions": [
"4.0.0",
"4.0.1"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-f6v3-2qmr-vfjx/GHSA-f6v3-2qmr-vfjx.json"
}
}
]- Related CVEs
- CVE-2026-61816
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #14233 · Revision 1
- Added to Heist Feed
- Publisher date