PMG: Several issues in libmime-tools-perl
CVE / CVSS
| CVE | CVSS | EPSS | Vector | Source |
|---|---|---|---|---|
| CVE-2026-116267 (opens in a new tab) Debian (opens in a new tab) | CVSS 7.5 High | 0.29 % | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD (v3.1) |
| CVE-2026-116268 (opens in a new tab) Debian (opens in a new tab) | CVSS 7.5 High | 0.29 % | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD (v3.1) |
| CVE-2026-116270 (opens in a new tab) Debian (opens in a new tab) | CVSS 7.5 High | 0.29 % | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD (v3.1) |
| CVE-2026-116273 (opens in a new tab) Debian (opens in a new tab) | CVSS 7.5 High | 0.29 % | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD (v3.1) |
| CVE-2026-116271 (opens in a new tab) Debian (opens in a new tab) | CVSS 7.0 High | 0.13 % | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD (v3.1) |
| CVE-2026-116264 (opens in a new tab) Debian (opens in a new tab) | CVSS 5.3 Medium | 0.21 % | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD (v3.1) |
| CVE-2026-116265 (opens in a new tab) Debian (opens in a new tab) | CVSS 5.3 Medium | 0.21 % | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD (v3.1) |
| CVE-2026-116266 (opens in a new tab) Debian (opens in a new tab) | CVSS 5.3 Medium | 0.21 % | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD (v3.1) |
| CVE-2026-116269 (opens in a new tab) Debian (opens in a new tab) | CVSS 5.3 Medium | 0.21 % | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD (v3.1) |
| CVE-2026-116272 (opens in a new tab) Debian (opens in a new tab) | CVSS 5.3 Medium | 0.21 % | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | NVD (v3.1) |
Base scores are looked up from NVD or, if NVD has none yet, the CVE record. Proxmox itself does not publish CVSS scores. “Actively exploited” comes from the CISA KEV catalog, EPSS (probability of exploitation in the next 30 days) from FIRST.
Affected packages
libmime-tools-perl, pmg-api
Details
The MIME::Tools package is used for parsing mails in Proxmox Mail Gateway. Recently two new releases for MIME::Tools were released upstream, fixing several issues, including 10, which were assigned CVE identifiers.
The issues can result in bypassing certain mail-filter rules similar to issues PSA-2026-00005-1 and PSA-2026-00049-1.
Additionally parsing certain messages could result in spending an excessive amount of CPU time by pmg-smtp-filter. PMG used the Max files setting of the Virus detector as general limit on the maximal number of parts in a mail since at least version 5.0. This effectively limited the effect of the unlimited CPU time.
The fixes for the issues were backported and are available in version 5.515-1+pmg3 of libmime-tools-perl.
Additionally a hard-coded limit on the nesting level of MIME parts was added as defense-in-depth.
We'd like to thank Dianne Skoll <[email protected]> for notifying us about releases and the issues that were fixed.
Fixed in
libmime-tools-perl (>= 5.515-1+pmg3), pmg-api (>= 9.1.5)
References
This page reproduces the official Proxmox forum post (opens in a new tab). The original is authoritative.