High
libemail-mime-perl — security advisory
An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
- Products
- libemail-mime-perl
- Affected versions
- 1.926-1, 1.936-1, 1.937-1, 1.946-1, 1.949-1, 1.952-1, 1.953-1, 1.954-1
- Fixed versions
- Not specified
- CVEs
- CVE-2024-4140
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:09 UTC · Revision 1
Source evidence
An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
osv:UBUNTU-CVE-2024-4140
libemail-mime-perl
Fixed versions: Not specified
libemail-mime-perl
Fixed versions: Not specified
libemail-mime-perl
Fixed versions: Not specified
libemail-mime-perl
Fixed versions: Not specified
libemail-mime-perl
Fixed versions: Not specified
libemail-mime-perl
Fixed versions: Not specified
libemail-mime-perl
Fixed versions: Not specified
libemail-mime-perl
Fixed versions: Not specified
Complete source record
{
"id": "fb09b25600a7741b05fe5bc77502c9864365582414314fe6a2a1eb9c33e22408",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-4140",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2024-4140",
"summary": "An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.",
"evidence": "osv:UBUNTU-CVE-2024-4140",
"products": [
{
"name": {
"value": "libemail-mime-perl",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.926-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.936-1",
"evidence": "/affected/0/versions"
},
{
"value": "1.937-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "libemail-mime-perl",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.937-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.946-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "libemail-mime-perl",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.946-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "libemail-mime-perl",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.949-1",
"evidence": "/affected/3/versions"
},
{
"value": "1.952-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "libemail-mime-perl",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.953-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "libemail-mime-perl",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.954-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "libemail-mime-perl",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.954-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "libemail-mime-perl",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.954-1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2024-4140",
"aliases": [
"UBUNTU-CVE-2024-4140"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libemail-mime-perl",
"purl": "pkg:deb/ubuntu/libemail-mime-perl?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1.926-1",
"1.936-1",
"1.937-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-4140.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libemail-mime-perl",
"binary_version": "1.937-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libemail-mime-perl",
"purl": "pkg:deb/ubuntu/libemail-mime-perl?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.937-1",
"1.946-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-4140.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libemail-mime-perl",
"binary_version": "1.946-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libemail-mime-perl",
"purl": "pkg:deb/ubuntu/libemail-mime-perl?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.946-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-4140.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libemail-mime-perl",
"binary_version": "1.946-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libemail-mime-perl",
"purl": "pkg:deb/ubuntu/libemail-mime-perl?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.949-1",
"1.952-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-4140.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libemail-mime-perl",
"binary_version": "1.952-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libemail-mime-perl",
"purl": "pkg:deb/ubuntu/libemail-mime-perl?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.953-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-4140.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libemail-mime-perl",
"binary_version": "1.953-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libemail-mime-perl",
"purl": "pkg:deb/ubuntu/libemail-mime-perl?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.954-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-4140.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libemail-mime-perl",
"binary_version": "1.954-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libemail-mime-perl",
"purl": "pkg:deb/ubuntu/libemail-mime-perl?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.954-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-4140.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libemail-mime-perl",
"binary_version": "1.954-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libemail-mime-perl",
"purl": "pkg:deb/ubuntu/libemail-mime-perl?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.954-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-4140.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libemail-mime-perl",
"binary_version": "1.954-1"
}
]
}
}
],
"modified": "2026-10-17T12:56:38.943207857Z",
"provider": "osv",
"upstream": [
"CVE-2024-4140"
],
"references": [
"https://ubuntu.com/security/CVE-2024-4140",
"https://www.cve.org/CVERecord?id=CVE-2024-4140"
]
},
"related_cves": [
{
"value": "CVE-2024-4140",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 355901,
"published_at": "2024-05-02T00:00:00+00:00"
}