mail-mime-parser EUVD-2026-86336

No special product configuration is required - the flaw affects any application using zbateson/mail-mime-parser versions 2.0.0 through 3.0.5 or 4.0.0/4.0.1 to parse attacker-supplied email. The single prerequisite is that the application actually parses the untrusted message (the cost is paid lazily on the first getAllParts() call or content read, not merely on receipt). Because the parsing paths are super-linear, an input byte-size cap does NOT limit exploitation. Mitigating/limiting factors: impact is availability-only; running parsing under a constrained PHP memory_limit and execution-time limit confines damage to the individual request rather than the whole host; and installations on non-affected lines (pre-2.0, or patched 3.0.6/4.0.2+) are unaffected.

This is a genuine but moderate-priority denial-of-service issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is well-supported by the description: any application that parses untrusted email with this library is exposed remotely, without authentication or user interaction, and the impact is purely availability (no confidentiality/integrity). The key technical signal is that three independent parsing paths are super-linear, so the common defensive control - a caller-side byte-size cap - does NOT bound the work; a message under 2 MB can burn seconds of CPU or exhaust hundreds of MB to multiple GB of memory, triggering an OOM kill. That said, exploitation impact is bounded to service disruption, and in a properly hardened PHP deployment (constrained memory_limit and max_execution_time) a malicious message tends to fail its own request rather than take down the host. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no evidence of active exploitation or automated weaponization - this reads as a real-but-not-urgent DoS to patch on a normal cadence, prioritized higher for internet-facing mail-processing services. No conflicting signals were found: the network vector matches the email-parsing use case.

An attacker sends a crafted email (under 2 MB) - with deeply nested multipart structure, an excessive header count/size, or many siblings - to any service that ingests and parses untrusted mail with this library. When the application first calls getAllParts() or reads content, the super-linear parsing paths consume seconds of CPU and gigabytes of memory, causing an out-of-memory kill and denial of service. No public exploit code is identified at time of analysis; exploitation requires no authentication or user interaction.