High
Security advisory
An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-4140
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 20:49 UTC · Revision 1
Source evidence
An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
osv:CVE-2024-4140
Complete source record
{
"id": "9709b560a53ed2d204c123cb33a2a08afab9097f81a3d4e0d15f55d0115eff68",
"url": "https://osv.dev/vulnerability/CVE-2024-4140",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2024-4140",
"summary": "An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.",
"evidence": "osv:CVE-2024-4140",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2024-4140",
"aliases": [
"CVE-2024-4140"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/rjbs/email-mime",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "d339016779f55c8842e10d3f15d273df26c6a0ad"
},
{
"fixed": "02bf3e26812c8f38a86a33c168571f9783365df2"
},
{
"fixed": "3a12edd119e493156a5a05e45dd50f4e36b702e8"
},
{
"fixed": "3dcf096eeccb8e4dd42738de676c8f4a5aa7a531"
},
{
"fixed": "7e96ecfa1da44914a407f82ae98ba817bba08f2d"
},
{
"fixed": "b2cb62f19e12580dd235f79e2546d44a6bec54d1"
},
{
"fixed": "fc0fededd24a71ccc51bcd8b1e486385d09aae63"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:rjbs:email-mime:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.954"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "02bf3e26812c8f38a86a33c168571f9783365df2"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "3a12edd119e493156a5a05e45dd50f4e36b702e8"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "3dcf096eeccb8e4dd42738de676c8f4a5aa7a531"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "7e96ecfa1da44914a407f82ae98ba817bba08f2d"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "b2cb62f19e12580dd235f79e2546d44a6bec54d1"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "fc0fededd24a71ccc51bcd8b1e486385d09aae63"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"1.946",
"1.945",
"1.944",
"1.941",
"1.940",
"1.939",
"1.938",
"1.937",
"1.936",
"1.935",
"1.934",
"1.933",
"1.932",
"1.931",
"1.930",
"1.929",
"1.928",
"1.927",
"1.926",
"1.925",
"1.924",
"1.923",
"1.922",
"1.921",
"1.920",
"1.912_01",
"1.911",
"1.910",
"1.909",
"1.908",
"1.907",
"1.906",
"1.905",
"1.904",
"1.903",
"1.902",
"1.901",
"1.900",
"1.863",
"1.862"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-4140.json"
}
}
],
"modified": "2026-10-28T02:30:23.766630211Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFD5BWGYAVLW6IO4SUNLTJCFFLHZYQGT/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YHXHDLPZ6JV4KK3Q43O6TE3WOBAIUQRC/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4140.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-4140",
"https://bugs.debian.org/960062",
"https://github.com/rjbs/Email-MIME/issues/66",
"https://github.com/rjbs/Email-MIME/pull/80",
"https://www.cve.org/CVERecord?id=CVE-2024-4140",
"https://github.com/rjbs/Email-MIME/commit/02bf3e26812c8f38a86a33c168571f9783365df2",
"https://github.com/rjbs/Email-MIME/commit/3a12edd119e493156a5a05e45dd50f4e36b702e8",
"https://github.com/rjbs/Email-MIME/commit/3dcf096eeccb8e4dd42738de676c8f4a5aa7a531",
"https://github.com/rjbs/Email-MIME/commit/7e96ecfa1da44914a407f82ae98ba817bba08f2d",
"https://github.com/rjbs/Email-MIME/commit/b2cb62f19e12580dd235f79e2546d44a6bec54d1",
"https://github.com/rjbs/Email-MIME/commit/fc0fededd24a71ccc51bcd8b1e486385d09aae63",
"https://github.com/rjbs/Email-MIME"
],
"provider_metadata": {
"cwe_ids": [
"CWE-770"
],
"cna_assigner": "canonical",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4140.json"
}
},
"related_cves": [
{
"value": "CVE-2024-4140",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 490006,
"published_at": "2024-05-02T19:59:20.917+00:00"
}