---
id: CVE-2026-61816
title: >-
  zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap*
  functions and Pear libraries for reading messages in Internet Message Format
  RFC 822
summary: >-
  zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap*
  functions and Pear libraries for reading messages in Internet Message Format
  RFC 822. Starting in version 2.0.0 and prior to version 3.0.6 and 4.0.2, an
  uncontrol…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
vendor: zbateson
product: zbateson/mail-mime-parser
affected:
  - 'zbateson/mail-mime-parser >= 2.0.0, < 3.0.6'
  - 'zbateson/mail-mime-parser >= 4.0.0, < 4.0.2'
patched:
  - zbateson/mail-mime-parser 3.0.6
  - zbateson/mail-mime-parser 4.0.2
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T19:17:15.240'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61816'
references:
  - url: >-
      https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx
    label: security-advisories@github.com
  - url: >-
      https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61816'
  - url: >-
      https://github.com/zbateson/mail-mime-parser/commit/1691e695821f70461f9554e9bb71be2859404a24
  - url: >-
      https://github.com/zbateson/mail-mime-parser/commit/fa44823ba9dd651e0eecec7aa45ac8c8e6afcb78
  - url: 'https://github.com/zbateson/mail-mime-parser/releases/tag/3.0.7'
  - url: 'https://github.com/zbateson/mail-mime-parser/releases/tag/4.0.2'
  - url: 'https://github.com/advisories/GHSA-f6v3-2qmr-vfjx'
tags:
  - nvd
  - ghsa
  - composer
  - cve.org
  - exploit-available
aliases:
  - GHSA-f6v3-2qmr-vfjx
ecosystem: composer
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-24T18:11:24.169203Z'
ingestedAt: '2026-09-24T18:49:36.710Z'
epss: 0.00393
epssPercentile: 0.30736
---

## Overview

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Starting in version 2.0.0 and prior to version 3.0.6 and 4.0.2, an uncontrolled resource consumption / algorithmic complexity vulnerability (CWE-400) affects any application that parses untrusted email with this library. Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does **not** bound the work done.  A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first `getAllParts()` or content read. This is fxed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions. Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.) These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-61816)

Affected packages:

- `zbateson/mail-mime-parser >= 2.0.0, < 3.0.6`
- `zbateson/mail-mime-parser >= 4.0.0, < 4.0.2`

Patched in:

- `zbateson/mail-mime-parser 3.0.6`
- `zbateson/mail-mime-parser 4.0.2`

Source: https://github.com/advisories/GHSA-f6v3-2qmr-vfjx