What's Changed
- Add a configurable limit on the total number of parts in a message, recording a parse error when reached (override via DI config) -- thanks @iam-niranjan:
maxMessagePartCount(default 10000) — maximum parts per message, MIME and uu-encoded
- Parse header values in O(n) rather than O(n²)
- Add configurable limits to header parsing, each recording a parse error when reached (override via DI config):
maxCommentDepth(default 32) — maximum nesting depth of parenthesised header commentsmaxHeaderTokenCount(default 20000) — maximum tokens parsed from a single header value; the remainder is kept as one unparsed token
Security
This release fixes a reported vulnerability:
- GHSA-pmx8-5pxm-f2r6 -- uncontrolled resource consumption (CPU/memory) when parsing untrusted messages, completing the fix for CVE-2026-61816.
Reported by @iam-niranjan, who identified the unbounded part counts and proposed fixes that informed the patches; the header parsing issues were found during the resulting review. Upgrading is recommended.