MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary
Impact
MIME::Field::ParamVal versions before 5.521 for Perl may hide parameters after an invalid Content-Type parameter, including the multipart boundary. A remote sender can exploit this to hide an attachment from filters. Parameter parsing stops at the first unreadable parameter name.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
Upgrade to MIME-tools 5.521 or later.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Vendor not supplied · CPANSec
MIME-tools
1 range
Vendor not supplied · CPANSec
MIME-tools
Package identity
pkg:cpan/MIME-toolsIdentity supplied by CPANSec. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 5.521
custom versions
Other versions: unaffected
Original source description
MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary.
Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded part without marking the parse as ambiguous.
Mail readers that skip the invalid parameter still find the boundary. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-116264View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.