MIME-tools before 5.521 for Perl fixes 10 CVEs
The visible flaws let one bad Content-Type parameter hide later parameters, including a multipart boundary.
46
CVE-2026-116264
Hidden multipart boundary in Perl MIME::Field::ParamVal before 5.521
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
MIME::Field::ParamVal in Perl stops reading Content-Type parameters at the first name it cannot parse, such as x:y=1 or a name with an 8-bit byte, and drops every later parameter, including the multipart boundary. MIME::Parser then keeps the body as one undecoded part and does not mark the parse ambiguous. A remote sender can hide an attachment from a filter that trusts ambiguous_content() while a mail client that skips the bad parameter still shows it. Affects versions before 5.521.
What to do: Upgrade MIME-tools (MIME::Field::ParamVal) to 5.521 or later so filters no longer drop the boundary after an unreadable parameter.
| Product | Affected | Fixed in |
|---|---|---|
| MIME-tools MIME::Field::ParamVal | before 5.521 | 5.521 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded part without marking the parse as ambiguous. Mail readers that skip the invalid parameter still find the boundary. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.
- Weakness
- CWE-436