https://db.gcve.eu/sightings/feed 2026-09-30T04:17:40.349904+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent sightings. https://db.gcve.eu/sighting/fbd9bc9e-d95b-4098-8322-d0788f3e08dc/export 2026-09-30T04:17:40.374263+00:00 sync_user https://db.gcve.eu/user/sync_user {"uuid": "fbd9bc9e-d95b-4098-8322-d0788f3e08dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61818", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwfpkw6xtt25", "content": "", "creation_timestamp": "2026-09-26T07:00:03.870847Z"} 2026-09-26T07:00:03.870847+00:00 https://db.gcve.eu/sighting/a40e142f-9e5f-4f32-badf-c4dbb0e7348a/export 2026-09-30T04:17:40.375655+00:00 sync_user https://db.gcve.eu/user/sync_user {"uuid": "a40e142f-9e5f-4f32-badf-c4dbb0e7348a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61818", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117335970277189695", "content": "", "creation_timestamp": "2026-09-26T06:40:41.732735Z"} 2026-09-26T06:40:41.732735+00:00 https://db.gcve.eu/sighting/1d4bedb1-e16f-410c-95bd-b56ee7fe8ee1/export 2026-09-30T04:17:40.375731+00:00 sync_user https://db.gcve.eu/user/sync_user {"uuid": "1d4bedb1-e16f-410c-95bd-b56ee7fe8ee1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61816", "type": "seen", "source": "https://gist.github.com/alon710/752908b52d1b5f088fc141196f91ca9b", "content": "# CVE-2026-61816: CVE-2026-61816: Uncontrolled Resource Consumption and Algorithmic Complexity in zbateson/mail-mime-parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61816\n\n## Summary\nThe PHP email processing library zbateson/mail-mime-parser is vulnerable to multiple algorithmic complexity exploits. By submitting small, highly structured email payloads, remote, unauthenticated attackers can trigger high CPU utilization or out-of-memory states, causing an application-wide denial of service.\n\n## TL;DR\nA denial of service vulnerability in zbateson/mail-mime-parser allows unauthenticated remote attackers to trigger severe CPU exhaustion or out-of-memory crashes by submitting malformed emails under 2 MB containing deeply nested boundaries, large header lists, or dense sibling attachments.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- zbateson/mail-mime-parser (PHP Package)\n- **mail-mime-parser**: >= 2.0.0, < 3.0.6 (Fixed in: `3.0.6`)\n- **mail-mime-parser**: >= 4.0.0, < 4.0.2 (Fixed in: `4.0.2`)\n\n## Mitigation\n\n- Update zbateson/mail-mime-parser to versions 3.0.6, 4.0.2, or newer.\n- Impose global constraints on memory_limit and max_execution_time within the PHP runtime configuration.\n- Deploy proxy-level or mail-transfer-agent (MTA) validation rules to drop exceptionally deep MIME hierarchies.\n\n**Remediation Steps:**\n1. Run 'composer update zbateson/mail-mime-parser' to download version 3.0.6 or 4.0.2.\n2. Review custom DI container setups to ensure they inherit the default values for 'maxMimePartDepth', 'maxHeaderCount', and 'maxHeaderSizeBytes'.\n3. Set 'memory_limit' to a conservative threshold (e.g. 128M) in php.ini to contain potential OOM outcomes.\n\n## References\n\n- [GHSA-f6v3-2qmr-vfjx: Uncontrolled resource consumption / algorithmic complexity DoS](https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx)\n- [CVE.org CVE-2026-61816 Vulnerability Record](https://www.cve.org/CVERecord?id=CVE-2026-61816)\n- [NVD - CVE-2026-61816 Analysis Dashboard](https://nvd.nist.gov/vuln/detail/CVE-2026-61816)\n- [Primary Configuration Limits and Depth Check Commit](https://github.com/zbateson/mail-mime-parser/commit/1691e695821f70461f9554e9bb71be2859404a24)\n- [Sibling Append Splice Optimization Commit](https://github.com/zbateson/mail-mime-parser/commit/fa44823ba9dd651e0eecec7aa45ac8c8e6afcb78)\n- [Release 3.0.7 GitHub Tag](https://github.com/zbateson/mail-mime-parser/releases/tag/3.0.7)\n- [Release 4.0.2 GitHub Tag](https://github.com/zbateson/mail-mime-parser/releases/tag/4.0.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61816) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T07:30:34.000000Z"} 2026-09-25T07:30:34+00:00 https://db.gcve.eu/sighting/5845c365-6bf3-4357-879b-ee8a9557ffe5/export 2026-09-30T04:17:40.375806+00:00 sync_user https://db.gcve.eu/user/sync_user {"uuid": "5845c365-6bf3-4357-879b-ee8a9557ffe5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61815", "type": "seen", "source": "https://gist.github.com/alon710/702cdfae67a6daa77470a0a110e821f9", "content": "", "creation_timestamp": "2026-09-25T06:30:32.000000Z"} 2026-09-25T06:30:32+00:00 https://db.gcve.eu/sighting/86706e13-5742-486c-a16f-0d8b2f7a027a/export 2026-09-30T04:17:40.375861+00:00 sync_user https://db.gcve.eu/user/sync_user {"uuid": "86706e13-5742-486c-a16f-0d8b2f7a027a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61817", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwagb4typa2i", "content": "", "creation_timestamp": "2026-09-24T04:30:12.475999Z"} 2026-09-24T04:30:12.475999+00:00 https://db.gcve.eu/sighting/c554d565-4b43-4e25-9a73-5ab670776af4/export 2026-09-30T04:17:40.375912+00:00 sync_user https://db.gcve.eu/user/sync_user {"uuid": "c554d565-4b43-4e25-9a73-5ab670776af4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61817", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117324133730193909", "content": "", "creation_timestamp": "2026-09-24T04:30:11.166307Z"} 2026-09-24T04:30:11.166307+00:00 https://db.gcve.eu/sighting/5178ed1c-c414-4bef-b9bd-1cf8e6548a1d/export 2026-09-30T04:17:40.375963+00:00 sync_user https://db.gcve.eu/user/sync_user {"uuid": "5178ed1c-c414-4bef-b9bd-1cf8e6548a1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61819", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mw2oxqjurs2p", "content": "", "creation_timestamp": "2026-09-21T21:50:02.280182Z"} 2026-09-21T21:50:02.280182+00:00 https://db.gcve.eu/sighting/af618ede-8051-4c59-90b9-597fe0d78164/export 2026-09-30T04:17:40.376013+00:00 sync_user https://db.gcve.eu/user/sync_user {"uuid": "af618ede-8051-4c59-90b9-597fe0d78164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61819", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117311196424440502", "content": "", "creation_timestamp": "2026-09-21T21:40:02.400962Z"} 2026-09-21T21:40:02.400962+00:00 https://db.gcve.eu/sighting/718e1502-49e2-4fb5-a8c7-fadcc4b66c53/export 2026-09-30T04:17:40.376062+00:00 sync_user https://db.gcve.eu/user/sync_user {"uuid": "718e1502-49e2-4fb5-a8c7-fadcc4b66c53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61819", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvxygxkils2p", "content": "", "creation_timestamp": "2026-09-20T20:01:38.897280Z"} 2026-09-20T20:01:38.897280+00:00 https://db.gcve.eu/sighting/dd851239-37c4-4168-8729-11548d42940e/export 2026-09-30T04:17:40.376111+00:00 sync_user https://db.gcve.eu/user/sync_user {"uuid": "dd851239-37c4-4168-8729-11548d42940e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61818", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvxygpqvmm2b", "content": "", "creation_timestamp": "2026-09-20T20:01:31.298506Z"} 2026-09-20T20:01:31.298506+00:00