CVE-2024-4140 json
An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipar…
published 2024-05-02 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-32700
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
Patch / fix
- rjbs Email-MIME 1.954
- rjbs email_mime 1.954
- libemail-mime-perl Debian 14, Debian 13 1.954-1
debian advisories DEBIAN-CVE-2024-4140
- perl-Email-MIME openSUSE Tumbleweed 1.954.0-1.1
opensuse advisories openSUSE-SU-2024:13973-1
- perl-email-mime Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 1.954-r0
alpine advisories ALPINE-CVE-2024-4140
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- github.com/rjbs/Email-MIME@3a12edd commit
- github.com/rjbs/Email-MIME@7e96ecf commit
- github.com/rjbs/Email-MIME@02bf3e2 commit
- github.com/rjbs/Email-MIME@fc0fede commit
- github.com/rjbs/Email-MIME@b2cb62f commit
- github.com/rjbs/Email-MIME@3dcf096 commit
- github.com/rjbs/Email-MIME#80 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
- rjbs Email-MIME
- rjbs email_mime
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/rjbs/Email-MIME/pull/80
issue-tracking
-
github.com
/rjbs/Email-MIME/commit/3a12edd119e493156a5a05e45dd50f4e36b702e8
patch
-
github.com
/rjbs/Email-MIME/commit/7e96ecfa1da44914a407f82ae98ba817bba08f2d
patch
-
github.com
/rjbs/Email-MIME/commit/02bf3e26812c8f38a86a33c168571f9783365df2
patch
-
github.com
/rjbs/Email-MIME/commit/fc0fededd24a71ccc51bcd8b1e486385d09aae63
patch
-
github.com
/rjbs/Email-MIME/commit/b2cb62f19e12580dd235f79e2546d44a6bec54d1
patch
-
github.com
/rjbs/Email-MIME/commit/3dcf096eeccb8e4dd42738de676c8f4a5aa7a531
patch
-
github.com
/rjbs/Email-MIME/issues/66
issue-tracking
-
bugs.debian.org
/960062
issue-tracking, mailing-list
-
cve.org
/CVERecord?id=CVE-2024-4140
issue-tracking, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/UFD5BWGYAVLW6IO4SUNLTJCFFLHZYQGT/
mailing-list
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/YHXHDLPZ6JV4KK3Q43O6TE3WOBAIUQRC/
mailing-list
Sources
- CVE List CVE-2024-4140
- NVD CVE-2024-4140
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.