CVE-2026-116269
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename. A parameter such as filename*=utf-8'en-US'payload.exe is converted to an encoded word with the language tag appended to the charset, and the decoder strips the language suffix only when it is a single word, so it cannot resolve UTF-8*EN-US and returns an empty string. The recommended_filename() method returns that empty string rather than falling back to the name parameter.
Risk Assessment
A remote sender can bypass a policy that checks file extensions on the recommended filename, since other mail readers return payload.exe while the library returns an empty name. This may lead to delivery of a malicious attachment to the recipient.
Recommendation
Update MIME::Field::ParamVal to version 5.521 or later. Do not rely solely on recommended_filename() in attachment policies — apply additional verification layers.
Other vulnerabilities in MIME::Field::ParamVal
See all- CVE-2026-116272Low risk· EPSS 7%
MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written as boundary((c))="A" is stored under that literal name, so a second boundary parameter is not reported as a duplicate and MIME::Parser splits the message on it.
- CVE-2026-116268Low risk· EPSS 7%
MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")", and in a field with no ")" every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.
- CVE-2026-116265Low risk· EPSS 7%
MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections (boundary*0=, boundary*1= and so on) is joined after they have run. A repeated section number is concatenated rather than reported as a duplicate, and from version 5.518 an encoded word or trailing whitespace in such a boundary also goes unflagged.
- CVE-2026-116264Low risk· EPSS 7%
MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded part without marking the parse as ambiguous.
Original NVD description (English source)
MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename. A parameter such as filename*=utf-8'en-US'payload.exe is converted to an encoded word with the language tag appended to the charset. The decoder strips the language suffix only when it is a single word, so it cannot resolve the charset UTF-8*EN-US and returns an empty string. The recommended_filename() method returns that empty string rather than falling back to the name parameter. Other mail readers return payload.exe. A remote sender can get an attachment past a policy that checks file extensions on the recommended filename.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS