Executive brief
zbateson/mail-mime-parser is a PHP library for parsing email messages. Three algorithmic complexity vulnerabilities in its MIME parser allow a crafted email message of just a few megabytes to consume seconds of CPU time or gigabytes of memory, causing denial of service. Applications that parse untrusted email with this library are vulnerable to crashes and service disruption.
Technical details
The library contains three distinct algorithmic complexity vulnerabilities in its MIME parsing logic. First, deep multipart nesting exhibits O(depth²) complexity due to recursive boundary testing against all ancestor parts, allowing a moderately sized message nested ~10,000 deep to hang during parsing. Second, handling many sibling MIME parts is O(n²) because each append operation reindexes the entire array via array_splice. Third, header parsing reads lines without limit on count or total size, allowing a few megabytes of headers to inflate to gigabytes in memory. Since parsing is lazy, the cost is incurred on the first getAllParts() call or content read. The fixes in versions 3.0.6 and 4.0.2 introduce configurable limits on nesting depth and header size, and optimize sibling append to O(n). Versions 2.x are end-of-life and unpatched.
Affected products
- zbateson mail-mime-parser before 3.0.6 and 4.0.2
Timeline
- 2026-09-24: disclosed: GHSA-f6v3-2qmr-vfjx published
- 2026-09-24: patched: Fixed in versions 3.0.6 and 4.0.2