PT-2024-29389 · Unknown+1 · Email-Mime+1

Marc Bradshaw + 2 · Published 2020-05-09 · Updated 2025-08-26 · CVE-2024-4140

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Email-MIME versions prior to 1.954

Description An excessive memory use issue exists in Email-MIME, which can cause denial of service when parsing multipart MIME messages. The issue is related to excessive depth and the total number of parts in these messages.

Recommendations For versions prior to 1.954, update to version 1.954 or later to resolve the issue. As a temporary workaround, consider limiting the depth and total number of parts when parsing multipart MIME messages to minimize the risk of denial of service.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2025-15229

CVE-2024-4140

MGASA-2024-0198

OPENSUSE-SU-2024:13973-1

Affected Products

Debian

Email-Mime

References · 30

• https://github.com/rjbs/Email-MIME/commit/fc0fededd24a71ccc51bcd8b1e486385d09aae63 · Patch
• https://github.com/rjbs/Email-MIME/commit/7e96ecfa1da44914a407f82ae98ba817bba08f2d · Patch
• https://github.com/rjbs/Email-MIME/commit/3dcf096eeccb8e4dd42738de676c8f4a5aa7a531 · Patch
• https://github.com/rjbs/Email-MIME/commit/02bf3e26812c8f38a86a33c168571f9783365df2 · Patch
• https://github.com/rjbs/Email-MIME/commit/3a12edd119e493156a5a05e45dd50f4e36b702e8 · Patch
• https://github.com/rjbs/Email-MIME/commit/b2cb62f19e12580dd235f79e2546d44a6bec54d1 · Patch
• https://ubuntu.com/security/CVE-2024-4140 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-4140 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15229 · Security Note
• https://osv.dev/vulnerability/MGASA-2024-0198 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YHXHDLPZ6JV4KK3Q43O6TE3WOBAIUQRC · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4140 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-4140 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13973-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-4140 · Vendor Advisory