# CVE-2026-121946: zbateson mail-mime-parser CRLF header injection

Source: https://junglewise.ai/threats/cve-2026-121946-zbateson-mail-mime-parser-before-3-0-9-and-4-x-before-4-0-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-121946 · Severity: high · CVSS 7.2 · Published 2026-11-04

zbateson mail-mime-parser is a PHP library for parsing and building MIME-formatted email messages. Versions before 3.0.9 and 4.x before 4.0.6 contain a flaw that allows attackers to inject extra email headers (such as Bcc) by supplying crafted MIME parameters that contain line-break characters. This could enable email spoofing or exposure of blind-copied recipients.

Technologies: [Zbateson Mail-Mime-Parser](https://junglewise.ai/threats/technologies/mail-mime-parser). Vendors: [Zbateson](https://junglewise.ai/threats/vendors/zbateson).

## Quick answers

**Is CVE-2026-121946 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121946 being exploited in the wild.

**How severe is CVE-2026-121946?** High severity, with a CVSS score of 7.2, published 4 November 2026.

**Which products and versions are affected?** Zbateson Mail-Mime-Parser before 3.0.9 and 4.x before 4.0.6.

**Is there a fix for CVE-2026-121946?** Yes: fixed in 3.0.9, 4.0.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121946 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121946?** Check whether you run Zbateson Mail-Mime-Parser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.9, 4.0.6

## Technical details

A CRLF header injection vulnerability exists in message-building helper functions that fail to strip CR (\r) and LF (\n) characters from MIME type, charset, encoding, micalg, and protocol parameter values before using them in header construction. An attacker can supply crafted values to inject additional header lines into outgoing messages. The vulnerability affects the MultipartHelper and UUEncodedPart classes, which are used when composing or modifying MIME messages.

## Affected products

- zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6

## Timeline

- 2026-11-04: disclosed

## References

- [https://github.com/zbateson/mail-mime-parser/blob/4.0.5/src/Message/Helper/MultipartHelper.php](https://github.com/zbateson/mail-mime-parser/blob/4.0.5/src/Message/Helper/MultipartHelper.php)
- [https://github.com/zbateson/mail-mime-parser/commit/1fa840ef367958e991e6840b4e3ffd41aca9d147](https://github.com/zbateson/mail-mime-parser/commit/1fa840ef367958e991e6840b4e3ffd41aca9d147)

## Related threats

- [zbateson mail-mime-parser uncontrolled resource consumption in MIME parsing](https://junglewise.ai/threats/cve-2026-61816-zbateson-mail-mime-parser-uncontrolled-resource-consumption-in)
- [zbateson mail-mime-parser CRLF header injection in attachment filename](https://junglewise.ai/threats/cve-2026-61815-zbateson-mail-mime-parser-crlf-header-injection-in-attachment)