MIME-tools before 5.521 for Perl fixes 10 CVEs
Original title: MIME-tools versions before 5.521 for Perl (10 CVEs)
The visible flaws let one bad Content-Type parameter hide later parameters, including a multipart boundary.
Robert Rothenberg posted on oss-security that MIME-tools versions before 5.521 for Perl address 10 CVEs. The excerpt says MIME::Field::ParamVal before 5.521 can let one invalid Content-Type parameter hide later parameters, including the multipart boundary, and does not flag an ambiguous boundary written as RFC 2231 continuations. MIME::Head from 5.518 before 5.521 is also cited for decoding a partly encoded value; the feed cuts off there.
Unconfirmed: The post says there are 10 CVEs, but the excerpt names only three and cuts off the third description.
- The fixed release named in the post is 5.521.
- CVE-2026-116264 concerns hidden Content-Type parameters.
- CVE-2026-116265 concerns ambiguous RFC 2231 multipart boundaries.
- CVE-2026-116266 applies to MIME::Head from 5.518 before 5.521.
Impact: Malformed MIME headers can hide or obscure multipart boundaries
| Product | Affected | Fixed in |
|---|---|---|
| MIME-tools MIME::Field::ParamVal | before 5.521 | 5.521 |
| MIME-tools MIME::Head | from 5.518 before 5.521 | 5.521 |
- 1.Upgrade MIME-tools for Perl to version 5.521.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-116264 | Hidden multipart boundary in Perl MIME::Field::ParamVal before 5.521 | — | — | ||
| CVE-2026-116265 | Unflagged multipart boundary ambiguity in Perl MIME::Field::ParamVal | — | — | ||
| CVE-2026-116266 | Ambiguous multipart boundary parsing in Perl MIME::Head | — | — |
From the original article
Posted by Robert Rothenberg on Oct 28 CVE-2026-116264 MIME::Field::ParamVal versions before 5. 521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary CVE-2026-116265 MIME::Field::ParamVal versions before 5. 521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations CVE-2026-116266 MIME::Head versions from 5.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.