AIKIDO-2026-323852

TL;DR

The MIME parser has three super-linear parsing paths: deep multipart nesting is O(depth^2) in MimeParserService::findContentBoundary(), appending many sibling parts is O(n^2) in PartChildrenContainer::add(), and header buffering in HeaderParserService::parse() caps neither header count nor total header size. A crafted message of only a few megabytes can therefore consume seconds of CPU or hundreds of megabytes to gigabytes of memory when parsed, leading to an out-of-memory kill and denial of service. Because the cost is super-linear, a caller-side byte-size cap does not bound the work performed. The fix adds configurable limits on multipart nesting depth and header count/total size and changes sibling append to linear cost.