{"vulnerability": "CVE-2026-6181", "sightings": [{"uuid": "5178ed1c-c414-4bef-b9bd-1cf8e6548a1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61819", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mw2oxqjurs2p", "content": "", "creation_timestamp": "2026-09-21T21:50:02.280182Z"}, {"uuid": "af618ede-8051-4c59-90b9-597fe0d78164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61819", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117311196424440502", "content": "", "creation_timestamp": "2026-09-21T21:40:02.400962Z"}, {"uuid": "718e1502-49e2-4fb5-a8c7-fadcc4b66c53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61819", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvxygxkils2p", "content": "", "creation_timestamp": "2026-09-20T20:01:38.897280Z"}, {"uuid": "dd851239-37c4-4168-8729-11548d42940e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61818", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvxygpqvmm2b", "content": "", "creation_timestamp": "2026-09-20T20:01:31.298506Z"}, {"uuid": "dc107107-50e7-46a4-8bb0-e106270a759d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61817", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mvxygq76ln26", "content": "", "creation_timestamp": "2026-09-20T20:01:29.552070Z"}, {"uuid": "78d7bef6-5630-4e7b-acd4-0c4e2146dd7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61817", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvxygicslv2s", "content": "", "creation_timestamp": "2026-09-20T20:01:22.981985Z"}, {"uuid": "edad21fb-ecad-4d25-911d-629ec6398446", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61814", "type": "seen", "source": "https://bsky.app/profile/eed3si9n.com/post/3mqsqe4xchk2e", "content": "", "creation_timestamp": "2026-07-17T02:47:35.863929Z"}, {"uuid": "86706e13-5742-486c-a16f-0d8b2f7a027a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61817", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwagb4typa2i", "content": "", "creation_timestamp": "2026-09-24T04:30:12.475999Z"}, {"uuid": "c554d565-4b43-4e25-9a73-5ab670776af4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61817", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117324133730193909", "content": "", "creation_timestamp": "2026-09-24T04:30:11.166307Z"}, {"uuid": "3574a231-7df8-4b0c-8327-60c6ad52212e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-6181", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/betvitqikixaz", "content": "", "creation_timestamp": "2026-08-11T06:50:25.241163Z"}, {"uuid": "5845c365-6bf3-4357-879b-ee8a9557ffe5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61815", "type": "seen", "source": "https://gist.github.com/alon710/702cdfae67a6daa77470a0a110e821f9", "content": "", "creation_timestamp": "2026-09-25T06:30:32.000000Z"}, {"uuid": "f088fcce-b492-4695-882c-187594289a61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61816", "type": "published-proof-of-concept", "source": "https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx", "content": "", "creation_timestamp": "2026-06-24T14:04:18.000000Z"}, {"uuid": "c2aea35b-d181-45e2-9ae8-4a3c72d40b40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61815", "type": "published-proof-of-concept", "source": "https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-36h5-qg4p-q2qf", "content": "", "creation_timestamp": "2026-06-24T14:04:28.000000Z"}, {"uuid": "1d4bedb1-e16f-410c-95bd-b56ee7fe8ee1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61816", "type": "seen", "source": "https://gist.github.com/alon710/752908b52d1b5f088fc141196f91ca9b", "content": "# CVE-2026-61816: CVE-2026-61816: Uncontrolled Resource Consumption and Algorithmic Complexity in zbateson/mail-mime-parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61816\n\n## Summary\nThe PHP email processing library zbateson/mail-mime-parser is vulnerable to multiple algorithmic complexity exploits. By submitting small, highly structured email payloads, remote, unauthenticated attackers can trigger high CPU utilization or out-of-memory states, causing an application-wide denial of service.\n\n## TL;DR\nA denial of service vulnerability in zbateson/mail-mime-parser allows unauthenticated remote attackers to trigger severe CPU exhaustion or out-of-memory crashes by submitting malformed emails under 2 MB containing deeply nested boundaries, large header lists, or dense sibling attachments.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- zbateson/mail-mime-parser (PHP Package)\n- **mail-mime-parser**: >= 2.0.0, < 3.0.6 (Fixed in: `3.0.6`)\n- **mail-mime-parser**: >= 4.0.0, < 4.0.2 (Fixed in: `4.0.2`)\n\n## Mitigation\n\n- Update zbateson/mail-mime-parser to versions 3.0.6, 4.0.2, or newer.\n- Impose global constraints on memory_limit and max_execution_time within the PHP runtime configuration.\n- Deploy proxy-level or mail-transfer-agent (MTA) validation rules to drop exceptionally deep MIME hierarchies.\n\n**Remediation Steps:**\n1. Run 'composer update zbateson/mail-mime-parser' to download version 3.0.6 or 4.0.2.\n2. Review custom DI container setups to ensure they inherit the default values for 'maxMimePartDepth', 'maxHeaderCount', and 'maxHeaderSizeBytes'.\n3. Set 'memory_limit' to a conservative threshold (e.g. 128M) in php.ini to contain potential OOM outcomes.\n\n## References\n\n- [GHSA-f6v3-2qmr-vfjx: Uncontrolled resource consumption / algorithmic complexity DoS](https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx)\n- [CVE.org CVE-2026-61816 Vulnerability Record](https://www.cve.org/CVERecord?id=CVE-2026-61816)\n- [NVD - CVE-2026-61816 Analysis Dashboard](https://nvd.nist.gov/vuln/detail/CVE-2026-61816)\n- [Primary Configuration Limits and Depth Check Commit](https://github.com/zbateson/mail-mime-parser/commit/1691e695821f70461f9554e9bb71be2859404a24)\n- [Sibling Append Splice Optimization Commit](https://github.com/zbateson/mail-mime-parser/commit/fa44823ba9dd651e0eecec7aa45ac8c8e6afcb78)\n- [Release 3.0.7 GitHub Tag](https://github.com/zbateson/mail-mime-parser/releases/tag/3.0.7)\n- [Release 4.0.2 GitHub Tag](https://github.com/zbateson/mail-mime-parser/releases/tag/4.0.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61816) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T07:30:34.000000Z"}, {"uuid": "a40e142f-9e5f-4f32-badf-c4dbb0e7348a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61818", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117335970277189695", "content": "", "creation_timestamp": "2026-09-26T06:40:41.732735Z"}, {"uuid": "fbd9bc9e-d95b-4098-8322-d0788f3e08dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-61818", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwfpkw6xtt25", "content": "", "creation_timestamp": "2026-09-26T07:00:03.870847Z"}]}