https://db.gcve.eu/sightings/feed 2026-09-26T17:13:10.802125+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent sightings. https://db.gcve.eu/sighting/1d4bedb1-e16f-410c-95bd-b56ee7fe8ee1/export 2026-09-26T17:13:10.816356+00:00 sync_user https://db.gcve.eu/user/sync_user {"uuid": "1d4bedb1-e16f-410c-95bd-b56ee7fe8ee1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61816", "type": "seen", "source": "https://gist.github.com/alon710/752908b52d1b5f088fc141196f91ca9b", "content": "# CVE-2026-61816: CVE-2026-61816: Uncontrolled Resource Consumption and Algorithmic Complexity in zbateson/mail-mime-parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61816\n\n## Summary\nThe PHP email processing library zbateson/mail-mime-parser is vulnerable to multiple algorithmic complexity exploits. By submitting small, highly structured email payloads, remote, unauthenticated attackers can trigger high CPU utilization or out-of-memory states, causing an application-wide denial of service.\n\n## TL;DR\nA denial of service vulnerability in zbateson/mail-mime-parser allows unauthenticated remote attackers to trigger severe CPU exhaustion or out-of-memory crashes by submitting malformed emails under 2 MB containing deeply nested boundaries, large header lists, or dense sibling attachments.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- zbateson/mail-mime-parser (PHP Package)\n- **mail-mime-parser**: >= 2.0.0, < 3.0.6 (Fixed in: `3.0.6`)\n- **mail-mime-parser**: >= 4.0.0, < 4.0.2 (Fixed in: `4.0.2`)\n\n## Mitigation\n\n- Update zbateson/mail-mime-parser to versions 3.0.6, 4.0.2, or newer.\n- Impose global constraints on memory_limit and max_execution_time within the PHP runtime configuration.\n- Deploy proxy-level or mail-transfer-agent (MTA) validation rules to drop exceptionally deep MIME hierarchies.\n\n**Remediation Steps:**\n1. Run 'composer update zbateson/mail-mime-parser' to download version 3.0.6 or 4.0.2.\n2. Review custom DI container setups to ensure they inherit the default values for 'maxMimePartDepth', 'maxHeaderCount', and 'maxHeaderSizeBytes'.\n3. Set 'memory_limit' to a conservative threshold (e.g. 128M) in php.ini to contain potential OOM outcomes.\n\n## References\n\n- [GHSA-f6v3-2qmr-vfjx: Uncontrolled resource consumption / algorithmic complexity DoS](https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx)\n- [CVE.org CVE-2026-61816 Vulnerability Record](https://www.cve.org/CVERecord?id=CVE-2026-61816)\n- [NVD - CVE-2026-61816 Analysis Dashboard](https://nvd.nist.gov/vuln/detail/CVE-2026-61816)\n- [Primary Configuration Limits and Depth Check Commit](https://github.com/zbateson/mail-mime-parser/commit/1691e695821f70461f9554e9bb71be2859404a24)\n- [Sibling Append Splice Optimization Commit](https://github.com/zbateson/mail-mime-parser/commit/fa44823ba9dd651e0eecec7aa45ac8c8e6afcb78)\n- [Release 3.0.7 GitHub Tag](https://github.com/zbateson/mail-mime-parser/releases/tag/3.0.7)\n- [Release 4.0.2 GitHub Tag](https://github.com/zbateson/mail-mime-parser/releases/tag/4.0.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61816) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T07:30:34.000000Z"} 2026-09-25T07:30:34+00:00 https://db.gcve.eu/sighting/f088fcce-b492-4695-882c-187594289a61/export 2026-09-26T17:13:10.818465+00:00 sync_user https://db.gcve.eu/user/sync_user {"uuid": "f088fcce-b492-4695-882c-187594289a61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61816", "type": "published-proof-of-concept", "source": "https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx", "content": "", "creation_timestamp": "2026-06-24T14:04:18.000000Z"} 2026-06-24T14:04:18+00:00