CVE-2024-4140
Detail
Description
An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
NVD assessment
not yet provided.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 Severity and Vector Strings:
NVD assessment
not yet provided.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected]
URL
Source(s)
Tag(s)
https://bugs.debian.org/960062
CVE, Canonical Ltd.
Mailing List
https://github.com/rjbs/Email-MIME/commit/02bf3e26812c8f38a86a33c168571f9783365df2
CVE, Canonical Ltd.
Patch
https://github.com/rjbs/Email-MIME/commit/3a12edd119e493156a5a05e45dd50f4e36b702e8
CVE, Canonical Ltd.
Patch
https://github.com/rjbs/Email-MIME/commit/3dcf096eeccb8e4dd42738de676c8f4a5aa7a531
CVE, Canonical Ltd.
Patch
https://github.com/rjbs/Email-MIME/commit/7e96ecfa1da44914a407f82ae98ba817bba08f2d
CVE, Canonical Ltd.
Patch
https://github.com/rjbs/Email-MIME/commit/b2cb62f19e12580dd235f79e2546d44a6bec54d1
CVE, Canonical Ltd.
Patch
https://github.com/rjbs/Email-MIME/commit/fc0fededd24a71ccc51bcd8b1e486385d09aae63
CVE, Canonical Ltd.
Patch
https://github.com/rjbs/Email-MIME/issues/66
CVE, Canonical Ltd.
Issue Tracking
https://github.com/rjbs/Email-MIME/pull/80
CVE, Canonical Ltd.
Issue Tracking
https://lists.fedoraproject.org/archives/list/[email protected] /message/UFD5BWGYAVLW6IO4SUNLTJCFFLHZYQGT/
CVE, Canonical Ltd.
Mailing List
https://lists.fedoraproject.org/archives/list/[email protected] /message/YHXHDLPZ6JV4KK3Q43O6TE3WOBAIUQRC/
CVE, Canonical Ltd.
Mailing List
https://www.cve.org/CVERecord?id=CVE-2024-4140
CVE, Canonical Ltd.
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-770
Allocation of Resources Without Limits or Throttling
Canonical Ltd.
Change History
8 change records found show changes
CVE Modified by CISA-ADP
6/17/2026 4:01:12 AM
Action
Type
Old Value
New Value
Added
Affected
[{"vendor":"rjbs","product":"email_mime","defaultStatus":"unknown","cpes":["cpe:2.3:a:rjbs:email_mime:1.954:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"1.954","versionType":"custom","status":"affected"}]}]
Added
SSVC
{"timestamp":"2024-05-21T15:51:07.201412Z","id":"CVE-2024-4140","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}
CVE Modified by Canonical Ltd.
6/17/2026 4:01:12 AM
Action
Type
Old Value
New Value
Added
Affected
[{"vendor":"rjbs","product":"Email-MIME","packageName":"libemail-mime-perl","platforms":["Linux"],"repo":"https://github.com/rjbs/Email-MIME","versions":[{"version":"0","lessThan":"1.954","versionType":"semver","status":"affected"}]}]
Initial Analysis by NIST
8/26/2025 1:21:28 PM
Action
Type
Old Value
New Value
Added
CPE Configuration
OR
*cpe:2.3:a:rjbs:email-mime:*:*:*:*:*:*:*:* versions up to (excluding) 1.954
Added
CPE Configuration
OR
*cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
*cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
Added
Reference Type
CVE: https://bugs.debian.org/960062 Types: Mailing List
Added
Reference Type
CVE: https://github.com/rjbs/Email-MIME/commit/02bf3e26812c8f38a86a33c168571f9783365df2 Types: Patch
Added
Reference Type
CVE: https://github.com/rjbs/Email-MIME/commit/3a12edd119e493156a5a05e45dd50f4e36b702e8 Types: Patch
Added
Reference Type
CVE: https://github.com/rjbs/Email-MIME/commit/3dcf096eeccb8e4dd42738de676c8f4a5aa7a531 Types: Patch
Added
Reference Type
CVE: https://github.com/rjbs/Email-MIME/commit/7e96ecfa1da44914a407f82ae98ba817bba08f2d Types: Patch
Added
Reference Type
CVE: https://github.com/rjbs/Email-MIME/commit/b2cb62f19e12580dd235f79e2546d44a6bec54d1 Types: Patch
Added
Reference Type
CVE: https://github.com/rjbs/Email-MIME/commit/fc0fededd24a71ccc51bcd8b1e486385d09aae63 Types: Patch
Added
Reference Type
CVE: https://github.com/rjbs/Email-MIME/issues/66 Types: Issue Tracking
Added
Reference Type
CVE: https://github.com/rjbs/Email-MIME/pull/80 Types: Issue Tracking
Added
Reference Type
CVE: https://lists.fedoraproject.org/archives/list/[email protected] /message/UFD5BWGYAVLW6IO4SUNLTJCFFLHZYQGT/ Types: Mailing List
Added
Reference Type
CVE: https://lists.fedoraproject.org/archives/list/[email protected] /message/YHXHDLPZ6JV4KK3Q43O6TE3WOBAIUQRC/ Types: Mailing List
Added
Reference Type
CVE: https://www.cve.org/CVERecord?id=CVE-2024-4140 Types: Third Party Advisory
Added
Reference Type
Canonical Ltd.: https://bugs.debian.org/960062 Types: Mailing List
Added
Reference Type
Canonical Ltd.: https://github.com/rjbs/Email-MIME/commit/02bf3e26812c8f38a86a33c168571f9783365df2 Types: Patch
Added
Reference Type
Canonical Ltd.: https://github.com/rjbs/Email-MIME/commit/3a12edd119e493156a5a05e45dd50f4e36b702e8 Types: Patch
Added
Reference Type
Canonical Ltd.: https://github.com/rjbs/Email-MIME/commit/3dcf096eeccb8e4dd42738de676c8f4a5aa7a531 Types: Patch
Added
Reference Type
Canonical Ltd.: https://github.com/rjbs/Email-MIME/commit/7e96ecfa1da44914a407f82ae98ba817bba08f2d Types: Patch
Added
Reference Type
Canonical Ltd.: https://github.com/rjbs/Email-MIME/commit/b2cb62f19e12580dd235f79e2546d44a6bec54d1 Types: Patch
Added
Reference Type
Canonical Ltd.: https://github.com/rjbs/Email-MIME/commit/fc0fededd24a71ccc51bcd8b1e486385d09aae63 Types: Patch
Added
Reference Type
Canonical Ltd.: https://github.com/rjbs/Email-MIME/issues/66 Types: Issue Tracking
Added
Reference Type
Canonical Ltd.: https://github.com/rjbs/Email-MIME/pull/80 Types: Issue Tracking
Added
Reference Type
Canonical Ltd.: https://lists.fedoraproject.org/archives/list/[email protected] /message/UFD5BWGYAVLW6IO4SUNLTJCFFLHZYQGT/ Types: Mailing List
Added
Reference Type
Canonical Ltd.: https://lists.fedoraproject.org/archives/list/[email protected] /message/YHXHDLPZ6JV4KK3Q43O6TE3WOBAIUQRC/ Types: Mailing List
Added
Reference Type
Canonical Ltd.: https://www.cve.org/CVERecord?id=CVE-2024-4140 Types: Third Party Advisory
CVE Modified by CVE
11/21/2024 4:42:15 AM
Action
Type
Old Value
New Value
Added
Reference
https://bugs.debian.org/960062
Added
Reference
https://github.com/rjbs/Email-MIME/commit/02bf3e26812c8f38a86a33c168571f9783365df2
Added
Reference
https://github.com/rjbs/Email-MIME/commit/3a12edd119e493156a5a05e45dd50f4e36b702e8
Added
Reference
https://github.com/rjbs/Email-MIME/commit/3dcf096eeccb8e4dd42738de676c8f4a5aa7a531
Added
Reference
https://github.com/rjbs/Email-MIME/commit/7e96ecfa1da44914a407f82ae98ba817bba08f2d
Added
Reference
https://github.com/rjbs/Email-MIME/commit/b2cb62f19e12580dd235f79e2546d44a6bec54d1
Added
Reference
https://github.com/rjbs/Email-MIME/commit/fc0fededd24a71ccc51bcd8b1e486385d09aae63
Added
Reference
https://github.com/rjbs/Email-MIME/issues/66
Added
Reference
https://github.com/rjbs/Email-MIME/pull/80
Added
Reference
https://lists.fedoraproject.org/archives/list/[email protected] /message/UFD5BWGYAVLW6IO4SUNLTJCFFLHZYQGT/
Added
Reference
https://lists.fedoraproject.org/archives/list/[email protected] /message/YHXHDLPZ6JV4KK3Q43O6TE3WOBAIUQRC/
Added
Reference
https://www.cve.org/CVERecord?id=CVE-2024-4140
CVE Modified by Canonical Ltd.
6/10/2024 2:15:36 PM
Action
Type
Old Value
New Value
Added
Reference
Canonical Ltd. https://lists.fedoraproject.org/archives/list/[email protected] /message/UFD5BWGYAVLW6IO4SUNLTJCFFLHZYQGT/ [No types assigned]
Added
Reference
Canonical Ltd. https://lists.fedoraproject.org/archives/list/[email protected] /message/YHXHDLPZ6JV4KK3Q43O6TE3WOBAIUQRC/ [No types assigned]
CVE Modified by Canonical Ltd.
5/14/2024 11:42:58 AM
Action
Type
Old Value
New Value
CVE Modified by Canonical Ltd.
5/02/2024 7:15:06 PM
Action
Type
Old Value
New Value
Added
Reference
Canonical Ltd. https://github.com/rjbs/Email-MIME/commit/02bf3e26812c8f38a86a33c168571f9783365df2 [No types assigned]
Added
Reference
Canonical Ltd. https://github.com/rjbs/Email-MIME/commit/3a12edd119e493156a5a05e45dd50f4e36b702e8 [No types assigned]
Added
Reference
Canonical Ltd. https://github.com/rjbs/Email-MIME/commit/3dcf096eeccb8e4dd42738de676c8f4a5aa7a531 [No types assigned]
Added
Reference
Canonical Ltd. https://github.com/rjbs/Email-MIME/commit/7e96ecfa1da44914a407f82ae98ba817bba08f2d [No types assigned]
Added
Reference
Canonical Ltd. https://github.com/rjbs/Email-MIME/commit/b2cb62f19e12580dd235f79e2546d44a6bec54d1 [No types assigned]
Added
Reference
Canonical Ltd. https://github.com/rjbs/Email-MIME/commit/fc0fededd24a71ccc51bcd8b1e486385d09aae63 [No types assigned]
New CVE Received from Canonical Ltd.
5/02/2024 4:15:07 PM
Action
Type
Old Value
New Value
Added
Description
An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
Added
CVSS V3.1
Canonical Ltd. AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Added
CWE
Canonical Ltd. CWE-770
Added
Reference
Canonical Ltd. https://bugs.debian.org/960062 [No types assigned]
Added
Reference
Canonical Ltd. https://github.com/rjbs/Email-MIME/issues/66 [No types assigned]
Added
Reference
Canonical Ltd. https://github.com/rjbs/Email-MIME/pull/80 [No types assigned]
Added
Reference
Canonical Ltd. https://www.cve.org/CVERecord?id=CVE-2024-4140 [No types assigned]
Quick Info
CVE Dictionary Entry: CVE-2024-4140 NVD
Published Date: 05/02/2024 NVD
Last Modified: 06/17/2026
Source: Canonical Ltd.
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
