# CVE-2026-61816: zbateson mail-mime-parser uncontrolled resource consumption in MIME parsing

Source: https://junglewise.ai/threats/cve-2026-61816-zbateson-mail-mime-parser-uncontrolled-resource-consumption-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61816 · Severity: high · CVSS 7.5 · Published 2026-09-24

zbateson/mail-mime-parser is a PHP library for parsing email messages. Three algorithmic complexity vulnerabilities in its MIME parser allow a crafted email message of just a few megabytes to consume seconds of CPU time or gigabytes of memory, causing denial of service. Applications that parse untrusted email with this library are vulnerable to crashes and service disruption.

Technologies: [Zbateson Mail-Mime-Parser](https://junglewise.ai/threats/technologies/mail-mime-parser). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Zbateson](https://junglewise.ai/threats/vendors/zbateson).

## Quick answers

**Is CVE-2026-61816 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61816 being exploited in the wild.

**How severe is CVE-2026-61816?** High severity, with a CVSS score of 7.5, published 24 September 2026.

**Which products and versions are affected?** zbateson/mail-mime-parser (Packagist) ECOSYSTEM:introduced=2.0.0,fixed=3.0.6; Zbateson Mail-Mime-Parser before 3.0.6 and 4.0.2.

**Is there a fix for CVE-2026-61816?** Yes. zbateson/mail-mime-parser (Packagist): upgrade to 3.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61816 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61816?** Check whether you run zbateson/mail-mime-parser (Packagist) or Zbateson Mail-Mime-Parser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- zbateson/mail-mime-parser (Packagist): upgrade to 3.0.6 or later

  ```sh
  composer require zbateson/mail-mime-parser:^3.0.6
  ```


## Technical details

The library contains three distinct algorithmic complexity vulnerabilities in its MIME parsing logic. First, deep multipart nesting exhibits O(depth²) complexity due to recursive boundary testing against all ancestor parts, allowing a moderately sized message nested ~10,000 deep to hang during parsing. Second, handling many sibling MIME parts is O(n²) because each append operation reindexes the entire array via array_splice. Third, header parsing reads lines without limit on count or total size, allowing a few megabytes of headers to inflate to gigabytes in memory. Since parsing is lazy, the cost is incurred on the first getAllParts() call or content read. The fixes in versions 3.0.6 and 4.0.2 introduce configurable limits on nesting depth and header size, and optimize sibling append to O(n). Versions 2.x are end-of-life and unpatched.

## Affected products

- zbateson mail-mime-parser before 3.0.6 and 4.0.2

## Identifiers

- CVE-2026-61816
- GHSA-f6v3-2qmr-vfjx

## Timeline

- 2026-09-24: disclosed: GHSA-f6v3-2qmr-vfjx published
- 2026-09-24: patched: Fixed in versions 3.0.6 and 4.0.2

## Related threats

- [zbateson mail-mime-parser CRLF header injection](https://junglewise.ai/threats/cve-2026-121946-zbateson-mail-mime-parser-before-3-0-9-and-4-x-before-4-0-6)
- [zbateson mail-mime-parser CRLF header injection in attachment filename](https://junglewise.ai/threats/cve-2026-61815-zbateson-mail-mime-parser-crlf-header-injection-in-attachment)