Resource allocation without limits in rjbs Email-MIME
Priority MEDIUM 41CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-770.
Summary
An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01132 66th percentileScored 2026-11-07
Fix Fixed Email-MIME (rjbs): 1.954
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rjbs | Email-MIME | before 1.954 | 1.954 | Patch available | CNA |
- Email-MIME Vendorrjbs Affected before 1.954 Fixed in 1.954 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rjbs:email-mime:*:*:*:*:*:*:*:* | before 1.954 | Vulnerable | rjbs |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* | 40 | Vulnerable | Fedoraproject |
- cpe:2.3:a:rjbs:email-mime:*:*:*:*:*:*:*:* Versions before 1.954 Vulnerable ·rjbs
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA Email-MIME (rjbs) Fixed in 1.954
Timeline
- 2026-10-02 Threatist record created from CVE-2024-4140
- 2026-10-03 Alias added: GHSA-2rhr-29cm-5chf
References
Patch 6
- https://github.com/rjbs/Email-MIME/commit/3a12edd119e493156a5a05e45dd50f4e36b702e8
- https://github.com/rjbs/Email-MIME/commit/7e96ecfa1da44914a407f82ae98ba817bba08f2d
- https://github.com/rjbs/Email-MIME/commit/02bf3e26812c8f38a86a33c168571f9783365df2
- https://github.com/rjbs/Email-MIME/commit/fc0fededd24a71ccc51bcd8b1e486385d09aae63
- https://github.com/rjbs/Email-MIME/commit/b2cb62f19e12580dd235f79e2546d44a6bec54d1
- https://github.com/rjbs/Email-MIME/commit/3dcf096eeccb8e4dd42738de676c8f4a5aa7a531
Other 5
- https://github.com/rjbs/Email-MIME/issues/66
- https://github.com/rjbs/Email-MIME/pull/80
- https://bugs.debian.org/960062
- https://lists.fedoraproject.org/archives/list/[email protected]/message/UFD5BWGYAVLW6IO4SUNLTJCFFLHZYQGT/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/YHXHDLPZ6JV4KK3Q43O6TE3WOBAIUQRC/
Sources
- CVE-2024-4140 · CVE Program
- CVE-2024-4140 · NVD
- FIRST EPSS
- GHSA-2rhr-29cm-5chf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences