zbateson/mail-mime-parser

Fixes #269 -- $streamPartEndPos in ZBateson\MailMimeParser\Parser\PartBuilder can be null when there is no body part in the mime message

Full Changelog: 4.0.4...4.0.5

What's Changed

• Add a configurable limit on the total number of parts in a message, recording a parse error when reached (override via DI config) -- thanks @iam-niranjan:
  • maxMessagePartCount (default 10000) — maximum parts per message, MIME and uu-encoded
• Parse header values in O(n) rather than O(n²)
• Add configurable limits to header parsing, each recording a parse error when reached (override via DI config):
  • maxCommentDepth (default 32) — maximum nesting depth of parenthesised header comments
  • maxHeaderTokenCount (default 20000) — maximum tokens parsed from a single header value; the remainder is kept as one unparsed token

Security

This release fixes a reported vulnerability:

• GHSA-pmx8-5pxm-f2r6 -- uncontrolled resource consumption (CPU/memory) when parsing untrusted messages, completing the fix for CVE-2026-61816.

Reported by @iam-niranjan, who identified the unbounded part counts and proposed fixes that informed the patches; the header parsing issues were found during the resulting review. Upgrading is recommended.

What's Changed

• Allow Guzzle PSR-7 v3 by @simPod in #268

New Contributors

• @simPod made their first contribution in #268

Full Changelog: 4.0.2...4.0.3

What's Changed

• Strip control characters (CR/LF) from attachment filenames and from decoded header parameter and MIME-encoded-word values -- thanks @iliaal
• Add configurable limits to MIME parsing, each recording a parse error when reached (override via DI config) -- thanks @iliaal:
  • maxMimePartDepth (default 256) — maximum multipart nesting depth
  • maxHeaderCount (default 1000) — maximum headers per part
  • maxHeaderSizeBytes (default 1048576) — maximum total header bytes per part
• Append child parts in O(n) rather than O(n²) -- thanks @iliaal
• Generate MIME boundaries with random_bytes() -- thanks @iliaal

Security

This release fixes two privately reported vulnerabilities:

• GHSA-36h5-qg4p-q2qf -- CRLF header injection via attachment filename.
• GHSA-f6v3-2qmr-vfjx -- uncontrolled resource consumption (CPU/memory) when parsing untrusted MIME.

Found and reported privately by @iliaal, who also proposed fixes that informed the patches. Upgrading is recommended.

Full Changelog: 4.0.0...4.0.1

Full Changelog: 3.0.5...4.0.0

What's Changed

• Strip control characters from the MIME type, charset, transfer encoding, micalg and protocol arguments of the message-building API, as is already done for attachment filenames -- thanks @manus-pi, @AlpetGexha and @kemrec
• Add configurable limits on the total number of headers, header bytes and header tokens parsed in a message, each recording a parse error when reached (override via DI config):
  • maxMessageHeaderCount (default 50000) — maximum headers read per message across all parts
  • maxMessageHeaderSizeBytes (default 8388608) — maximum header bytes read per message across all parts
  • maxMessageHeaderTokenCount (default 250000) — maximum header tokens parsed per message across all parts; headers parsed after it is reached are kept as one unparsed token each
• Read past the rest of a part's headers when a header limit is reached, rather than treating them as the part's content
• Skip building the error logging context when no logger is configured
• Lower the default maxMessagePartCount from 10000 to 1000
• Parse quoted header values in O(n) rather than O(n²) -- thanks @manus-pi
• Parse address groups and RFC 2231 split parameters in O(n) rather than O(n²)
• Match multipart boundary lines in constant time regardless of nesting depth
• Parse each part's Content-Type header once rather than twice
• Keep only the mime-encoded header parts that recorded decoding errors, rather than every part
• Strip control characters from uuencoded part filenames and from the remaining message-building helper arguments

Security

This release fixes two reported vulnerabilities:

• GHSA-gmgm-r6fh-fq6g -- header injection through message-building arguments not covered by the fix for CVE-2026-61815.
• GHSA-fcgh-j754-jh42 -- uncontrolled resource consumption (CPU/memory) when parsing untrusted messages, not covered by the fixes for CVE-2026-61816 and GHSA-pmx8-5pxm-f2r6.

Reported by @manus-pi, @AlpetGexha and @kemrec; the unbounded per-message header memory was found during the resulting review. Upgrading is recommended.

What's Changed

• Add a configurable limit on the total number of parts in a message, recording a parse error when reached (override via DI config) -- thanks @iam-niranjan:
• maxMessagePartCount (default 10000) — maximum parts per message, MIME and uu-encoded
• Parse header values in O(n) rather than O(n²)
• Add configurable limits to header parsing, each recording a parse error when reached (override via DI config): maxCommentDepth (default 32) — maximum nesting depth of parenthesised header comments
• maxHeaderTokenCount (default 20000) — maximum tokens parsed from a single header value; the remainder is kept as one unparsed token

Security

This release fixes a reported vulnerability:

• GHSA-pmx8-5pxm-f2r6 -- uncontrolled resource consumption (CPU/memory) when parsing untrusted messages, completing the fix for GHSA-f6v3-2qmr-vfjx.

Reported by @iam-niranjan, who identified the unbounded part counts and proposed fixes that informed the patches; the header parsing issues were found during the resulting review. Upgrading is recommended.

What's Changed

• Add a configurable limit on the total number of parts in a message, recording a parse error when reached (override via DI config) -- thanks @iam-niranjan:
  • maxMessagePartCount (default 10000) — maximum parts per message, MIME and uu-encoded
• Parse header values in O(n) rather than O(n²)
• Add configurable limits to header parsing, each recording a parse error when reached (override via DI config):
  • maxCommentDepth (default 32) — maximum nesting depth of parenthesised header comments
  • maxHeaderTokenCount (default 20000) — maximum tokens parsed from a single header value; the remainder is kept as one unparsed token

Security

This release fixes a reported vulnerability:

• GHSA-pmx8-5pxm-f2r6 -- uncontrolled resource consumption (CPU/memory) when parsing untrusted messages, completing the fix for CVE-2026-61816.

Reported by @iam-niranjan, who identified the unbounded part counts and proposed fixes that informed the patches; the header parsing issues were found during the resulting review. Upgrading is recommended.

What's Changed

• Strip control characters (CR/LF) from attachment filenames and from decoded header parameter and MIME-encoded-word values -- thanks @iliaal
• Add configurable limits to MIME parsing, each recording a parse error when reached (override via DI config) -- thanks @iliaal:
  • maxMimePartDepth (default 256) — maximum multipart nesting depth
  • maxHeaderCount (default 1000) — maximum headers per part
  • maxHeaderSizeBytes (default 1048576) — maximum total header bytes per part
• Append child parts in O(n) rather than O(n²) -- thanks @iliaal.
• Generate MIME boundaries with random_bytes() -- thanks @iliaal.

Security

This release fixes two privately reported vulnerabilities:

• GHSA-36h5-qg4p-q2qf -- CRLF header injection via attachment filename.
• GHSA-f6v3-2qmr-vfjx -- uncontrolled resource consumption (CPU/memory) when parsing untrusted MIME.

Found and reported privately by @iliaal, who also proposed fixes that informed the patches. Upgrading is recommended.

What's Changed

• Php 8.5 support by @phpfui in #260

Full Changelog: 3.0.4...3.0.5

What's Changed

• Fix getAttachmentPart typo in IMessage.php docs by @seanmckenzie428 in #245

New Contributors

• @seanmckenzie428 made their first contribution in #245

Full Changelog: 3.0.3...3.0.4

• Fix to allow empty address groups #241
• Ignore ws between rfc2047 parts in q-part #240
• Fix PartBuilder parent parameter type

Full Changelog: 3.0.2...3.0.3

What's Changed

• Replace global DI library functions with corresponding objects for PRS-4 compliance by @phpfui in #238

Full Changelog: 3.0.1...3.0.2

Fixes version constraints for php-di, guzzlehttp/psr7 and phpunit.