{"metadata": {"vulnerability": "CVE-2026-61816", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}, "linked_omitted": 0}, "data": [{"timestamp": "2026-06-24T14:04:18Z", "date_only": false, "value": "2026-06-24T14:04:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx", "record": "CVE-2026-61816", "field": "creation_timestamp", "uuid": "f088fcce-b492-4695-882c-187594289a61", "url": "https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-10T20:17:57.992Z", "date_only": false, "value": "2026-07-10T20:17:57.992Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-61816", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-24T17:55:11.439Z", "date_only": false, "value": "2026-09-24T17:55:11.439Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61816", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-24T17:55:11.439Z", "date_only": false, "value": "2026-09-24T17:55:11.439Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-61816", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-24T18:11:24.169Z", "date_only": false, "value": "2026-09-24T18:11:24.169203Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61816", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-24T18:11:24.169Z", "date_only": false, "value": "2026-09-24T18:11:24.169203Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61816", "record": "FKIE_CVE-2026-61816", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-09-24T18:11:49.772Z", "date_only": false, "value": "2026-09-24T18:11:49.772Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-61816", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-24T18:11:49.772Z", "date_only": false, "value": "2026-09-24T18:11:49.772Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61816", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-24T18:17:17Z", "date_only": false, "value": "2026-09-24T18:17:17Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F6V3-2QMR-VFJX", "record": "GHSA-F6V3-2QMR-VFJX", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-09-24T18:17:17.303Z", "date_only": false, "value": "2026-09-24T18:17:17.303", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61816", "record": "FKIE_CVE-2026-61816", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-24T19:45:05Z", "date_only": false, "value": "2026-09-24T19:45:05Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F6V3-2QMR-VFJX", "record": "GHSA-F6V3-2QMR-VFJX", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-09-24T19:45:05Z", "date_only": false, "value": "2026-09-24T19:45:05Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F6V3-2QMR-VFJX", "record": "GHSA-F6V3-2QMR-VFJX", "field": "modified", "linked_record": true}, {"timestamp": "2026-09-25T07:30:34Z", "date_only": false, "value": "2026-09-25T07:30:34.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/752908b52d1b5f088fc141196f91ca9b", "record": "CVE-2026-61816", "field": "creation_timestamp", "uuid": "1d4bedb1-e16f-410c-95bd-b56ee7fe8ee1", "content": "# CVE-2026-61816: CVE-2026-61816: Uncontrolled Resource Consumption and Algorithmic Complexity in zbateson/mail-mime-parser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61816\n\n## Summary\nThe PHP email processing library zbateson/mail-mime-parser is vulnerable to multiple algorithmic complexity exploits. By submitting small, highly structured email payloads, remote, unauthenticated attackers can trigger high CPU utilization or out-of-memory states, causing an application-wide denial of service.\n\n## TL;DR\nA denial of service vulnerability in zbateson/mail-mime-parser allows unauthenticated remote attackers to trigger severe CPU exhaustion or out-of-memory crashes by submitting malformed emails under 2 MB containing deeply nested boundaries, large header lists, or dense sibling attachments.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.5 (High)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof of Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- zbateson/mail-mime-parser (PHP Package)\n- **mail-mime-parser**: >= 2.0.0, < 3.0.6 (Fixed in: `3.0.6`)\n- **mail-mime-parser**: >= 4.0.0, < 4.0.2 (Fixed in: `4.0.2`)\n\n## Mitigation\n\n- Update zbateson/mail-mime-parser to versions 3.0.6, 4.0.2, or newer.\n- Impose global constraints on memory_limit and max_execution_time within the PHP runtime configuration.\n- Deploy proxy-level or mail-transfer-agent (MTA) validation rules to drop exceptionally deep MIME hierarchies.\n\n**Remediation Steps:**\n1. Run 'composer update zbateson/mail-mime-parser' to download version 3.0.6 or 4.0.2.\n2. Review custom DI container setups to ensure they inherit the default values for 'maxMimePartDepth', 'maxHeaderCount', and 'maxHeaderSizeBytes'.\n3. Set 'memory_limit' to a conservative threshold (e.g. 128M) in php.ini to contain potential OOM outcomes.\n\n## References\n\n- [GHSA-f6v3-2qmr-vfjx: Uncontrolled resource consumption / algorithmic complexity DoS](https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx)\n- [CVE.org CVE-2026-61816 Vulnerability Record](https://www.cve.org/CVERecord?id=CVE-2026-61816)\n- [NVD - CVE-2026-61816 Analysis Dashboard](https://nvd.nist.gov/vuln/detail/CVE-2026-61816)\n- [Primary Configuration Limits and Depth Check Commit](https://github.com/zbateson/mail-mime-parser/commit/1691e695821f70461f9554e9bb71be2859404a24)\n- [Sibling Append Splice Optimization Commit](https://github.com/zbateson/mail-mime-parser/commit/fa44823ba9dd651e0eecec7aa45ac8c8e6afcb78)\n- [Release 3.0.7 GitHub Tag](https://github.com/zbateson/mail-mime-parser/releases/tag/3.0.7)\n- [Release 4.0.2 GitHub Tag](https://github.com/zbateson/mail-mime-parser/releases/tag/4.0.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61816) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/752908b52d1b5f088fc141196f91ca9b"}, {"timestamp": "2026-09-30T17:32:07.107Z", "date_only": false, "value": "2026-09-30T17:32:07.107", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61816", "record": "FKIE_CVE-2026-61816", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-14T01:25:47.139Z", "anchors": {"origin": {"timestamp": "2026-09-24T17:55:11.439Z", "date_only": false, "value": "2026-09-24T17:55:11.439Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61816", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-09-24T17:55:11.439Z", "date_only": false, "value": "2026-09-24T17:55:11.439Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61816", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-06-24T14:04:18Z", "date_only": false, "value": "2026-06-24T14:04:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx", "record": "CVE-2026-61816", "field": "creation_timestamp", "uuid": "f088fcce-b492-4695-882c-187594289a61", "url": "https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -7962653.439, "hours": -2211.8481775, "days": -92.16034072916666, "min_seconds": -7962653.439, "max_seconds": -7962653.439, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-09-24T17:55:11.439Z", "date_only": false, "value": "2026-09-24T17:55:11.439Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61816", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-06-24T14:04:18Z", "date_only": false, "value": "2026-06-24T14:04:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx", "record": "CVE-2026-61816", "field": "creation_timestamp", "uuid": "f088fcce-b492-4695-882c-187594289a61", "url": "https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 4347035.700027, "hours": 1207.5099166741668, "days": 50.312913194756945, "min_seconds": 4347035.700027, "max_seconds": 4347035.700027, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-24T17:55:11.439Z", "date_only": false, "value": "2026-09-24T17:55:11.439Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61816", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T01:25:47.139Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 12309689.139027, "hours": 3419.3580941741666, "days": 142.4732539239236, "min_seconds": 12309689.139027, "max_seconds": 12309689.139027, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-24T14:04:18Z", "date_only": false, "value": "2026-06-24T14:04:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx", "record": "CVE-2026-61816", "field": "creation_timestamp", "uuid": "f088fcce-b492-4695-882c-187594289a61", "url": "https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T01:25:47.139Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}