CVE-2026-42504

What it actually does

This vulnerability is a remote, unauthenticated denial-of-service condition in MIME header decoding. A specially crafted message header containing a large number of invalid RFC 2047 encoded-words can force the decoder into excessive CPU work while attempting to parse or recover from malformed input. The impact is availability-only: successful exploitation can consume processing resources, slow message handling, block worker threads, or degrade the service that parses MIME content. The CVSS vector indicates network exploitability, low attack complexity, no privileges required, and no user interaction required.

Why it matters to the business

Organizations that operate mail gateways, ticketing systems, notification pipelines, content scanners, or other services that ingest MIME-formatted messages may experience service degradation or outages if exposed components process malicious headers. The practical impact is delayed or failed email/message processing, increased infrastructure load, and potential disruption to business workflows that depend on automated message ingestion. The EPSS score is currently low and there is no known KEV listing or ransomware association, but the flaw is simple to trigger if a vulnerable parser is reachable.

How an attack unfolds

An attacker identifies an application or service that accepts MIME messages or MIME-like headers over a network-facing path, such as SMTP, HTTP upload, API-based message ingestion, or a mail-processing queue. The attacker sends a message with headers containing many malformed encoded-word sequences. When the vulnerable component decodes the header, it repeatedly attempts to process the invalid encoded-words, consuming excessive CPU. By sending one or more such messages, the attacker can tie up parsing workers or saturate CPU resources, causing slowdowns, backlogs, timeouts, or service unavailability. No authentication, prior access, or victim interaction is required if the vulnerable parser is exposed to untrusted input.

How to fix it

Upgrade the affected MIME parsing or mail-processing software to a version that contains the vendor fix when available. Because no affected products or fixed versions were provided, inventory systems and applications that parse MIME headers and consult the relevant vendor advisories for exact patched releases. Where immediate patching is not possible, reduce exposure by limiting unauthenticated message ingestion, enforcing maximum header length and header count limits, applying rate limits per sender/source, rejecting malformed encoded-words early, and isolating MIME parsing workloads with CPU and queue controls. Ensure downstream services that embed the vulnerable decoder are also updated, not only directly installed packages.

How to confirm the fix worked

Confirm that all applications, services, containers, and dependencies that parse MIME headers are running fixed versions once vendor patches are available. Validate exposure by reviewing externally reachable SMTP, mail gateway, API, upload, ticketing, and content-scanning paths that accept MIME input. In a controlled non-production environment, test parser behavior with malformed encoded-word-heavy headers and confirm processing is rejected quickly or bounded by resource limits. Monitor CPU utilization, queue depth, worker saturation, and message-processing latency before and after remediation to confirm that malformed headers no longer cause disproportionate resource consumption.

Typical attack path

1. Identify a service that accepts or relays MIME-formatted content from untrusted sources.
2. Craft MIME headers with a high volume of invalid encoded-word patterns.
3. Submit the crafted message through an exposed protocol or ingestion path.
4. Trigger the vulnerable MIME decoder during header parsing.
5. Repeat submissions as needed to exhaust CPU, delay processing, or cause service timeouts.

How to detect it

Look for signs of resource-exhaustion attempts against services that parse MIME content. Relevant log sources include SMTP gateway logs, mail transfer agent logs, mail security gateway logs, web/API upload logs, ticketing or helpdesk ingestion logs, application parser logs, container and host CPU metrics, worker timeout logs, and message queue telemetry. Investigate clusters of messages with unusually long headers, repeated malformed RFC 2047 encoded-word sequences, parsing exceptions, worker timeouts, CPU spikes, growing mail or ingestion queues, and repeated submissions from the same source around the same time. If full message headers are retained, search for excessive occurrences of encoded-word delimiters in a single header, especially malformed sequences that begin with `=?` but do not form valid encoded-words. Correlate suspicious messages with service degradation, increased parse latency, or CPU saturation. No named threat actors or active exploitation campaigns are currently provided for this vulnerability.

What your security team should do

• Inventory all internet-facing and internally exposed services that ingest MIME messages or MIME-like headers.
• Identify the specific MIME decoding libraries or products in use and track vendor advisories for fixed versions related to this vulnerability.
• Patch or upgrade vulnerable components as soon as fixed releases are available, prioritizing externally reachable mail and message-ingestion services.
• Implement compensating controls: header size limits, malformed-header rejection, sender/source rate limiting, queue isolation, and CPU limits for parsing workers.
• Add monitoring for sudden CPU spikes, message-processing backlogs, repeated malformed header parsing errors, and high volumes of rejected MIME messages.
• Review logs for historical evidence of malformed encoded-word floods, especially around availability incidents or unexplained CPU saturation.
• Because exploit maturity is currently reported as none and EPSS is low, prioritize based on exposure, criticality of message-processing workflows, and ease of patching rather than KEV-driven emergency timelines.