Proxmox Mail Gateway - Security Advisories

[ProxmoxSecurityAdvisory]

Subject: PSA-2026-00091-1: PMG: Several issues in libmime-tools-perl​

Advisory date: 2026-11-10

Packages: libmime-tools-perl, pmg-api

Details:

The MIME::Tools package is used for parsing mails in Proxmox Mail Gateway. Recently two new releases for MIME::Tools were released upstream, fixing several issues, including 10, which were assigned CVE identifiers.

The issues can result in bypassing certain mail-filter rules similar to issues PSA-2026-00005-1 and PSA-2026-00049-1.

Additionally parsing certain messages could result in spending an excessive amount of CPU time by pmg-smtp-filter. PMG used the Max files setting of the Virus detector as general limit on the maximal number of parts in a mail since at least version 5.0. This effectively limited the effect of the unlimited CPU time.

The fixes for the issues were backported and are available in version 5.515-1+pmg3 of libmime-tools-perl.

Additionally a hard-coded limit on the nesting level of MIME parts was added as defense-in-depth.

We'd like to thank Dianne Skoll <dianne@skoll.ca> for notifying us about releases and the issues that were fixed.

Fixed in: libmime-tools-perl (>= 5.515-1+pmg3), pmg-api (>= 9.1.5)

References:
- CVE-2026-116264
- CVE-2026-116265
- CVE-2026-116266
- CVE-2026-116267
- CVE-2026-116268
- CVE-2026-116269
- CVE-2026-116270
- CVE-2026-116271
- CVE-2026-116272
- CVE-2026-116273

 

[ProxmoxSecurityAdvisory]

Subject: PSA-2026-00089-1: Several issues in libpve-http-server-perl​

Advisory date: 2026-11-10

Packages: libpve-http-server-perl

Details:

Several issues were found and fixed in the Perl HTTP server used by Proxmox VE and Proxmox Mail Gateway.

The access log handling was improved to avoid interleaved writes to the log file and injection of unescaped special values in log lines.

The request handling was improved to reject duplicate Content-Length, Host or Cookie HTTP header values, to avoid mapping underscores to hyphens in HTTP header names and to reject requests with extremely long query strings.

The duplicate header value issue was reported privately by Apo - CSB Raccoon Labs <csb-raccoon@protonmail.com>, the rest was found internally.

Fixed in:
- libpve-http-server-perl >= 6.0.6