Detections
Analytics

SCA: security update for zbateson/mail-mime-parser (GHSA-f6v3-2qmr-vfjx)

high Tenable Cloud Security Plugin ID 448338

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries
 for reading messages in Internet Message Format RFC 822. Starting in version 2.0.0 and prior to version
 3.0.6 and 4.0.2, an uncontrolled resource consumption / algorithmic complexity vulnerability (CWE-400)
 affects any application that parses untrusted email with this library. Three independent parsing paths are
 super-linear in cost, so a byte-size cap on the caller side does **not** bound the work done. A crafted
 message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory
 (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on
 the first `getAllParts()` or content read. This is fxed in 4.0.2 and 3.0.6. The fixes add configurable
 limits on multipart nesting depth and on header count / total header size (recording a parse error past
 the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of
 these (or later) versions. Versions 2.x are also affected but are end-of-life and will not receive
 patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different
 parser and are not affected by all three paths.) These costs are super-linear, so an input byte-size cap
 alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run
 parsing under a constrained memory_limit and execution time limit so a malicious message fails its own
 request rather than exhausting the host. (CVE-2026-61816)

Solution

Update the zbateson/mail-mime-parser library and its related packages to version 3.0.6 or later.

See Also

https://github.com/advisories/GHSA-f6v3-2qmr-vfjx

Plugin Details

Severity: High

ID: 448338

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 9/25/2026

Updated: 9/25/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.61

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-61816

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/24/2026

Vulnerability Publication Date: 9/24/2026

Reference Information

CVE: CVE-2026-61816

cwe: CWE-400