CVE-2026-116265
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections (boundary*0=, boundary*1= and so on) is joined after they have run. A repeated section number is concatenated rather than reported as a duplicate, and from version 5.518 an encoded word or trailing whitespace in such a boundary also goes unflagged.
Risk Assessment
A remote sender can make MIME::Parser split a message on a different boundary than other mail readers, hiding an attachment from a filter relying on ambiguous_content() while the recipient's mail client shows it. This may lead to delivery of a malicious attachment to the recipient.
Recommendation
Update MIME::Field::ParamVal to version 5.521 or later. Do not rely solely on ambiguous_content() in mail security filters — apply additional attachment verification layers.
Other vulnerabilities in MIME::Field::ParamVal
See all- CVE-2026-116272Low risk· EPSS 7%
MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written as boundary((c))="A" is stored under that literal name, so a second boundary parameter is not reported as a duplicate and MIME::Parser splits the message on it.
- CVE-2026-116269Low risk· EPSS 7%
MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename. A parameter such as filename*=utf-8'en-US'payload.exe is converted to an encoded word with the language tag appended to the charset, and the decoder strips the language suffix only when it is a single word, so it cannot resolve UTF-8*EN-US and returns an empty string. The recommended_filename() method returns that empty string rather than falling back to the name parameter.
- CVE-2026-116268Low risk· EPSS 7%
MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")", and in a field with no ")" every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.
- CVE-2026-116264Low risk· EPSS 7%
MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded part without marking the parse as ambiguous.
Original NVD description (English source)
MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections (boundary*0=, boundary*1= and so on) is joined after they have run. A repeated section number is concatenated rather than reported as a duplicate. From version 5.518, an encoded word or trailing whitespace in such a boundary also goes unflagged, although multipart_boundary() decodes or strips it. A remote sender can make MIME::Parser split a message on a different boundary than other mail readers, hiding an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS