MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations
Impact
MIME::Field::ParamVal versions before 5.521 for Perl do not flag ambiguous multipart boundaries, allowing a remote sender to potentially hide attachments. The issue arises from incomplete boundary ambiguity checks. A sender can exploit this weakness.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
Upgrade to MIME-tools 5.521 or later.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Vendor not supplied · CPANSec
MIME-tools
1 range
Vendor not supplied · CPANSec
MIME-tools
Package identity
pkg:cpan/MIME-toolsIdentity supplied by CPANSec. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 5.521
custom versions
Other versions: unaffected
Original source description
MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations.
The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections (boundary0=, boundary1= and so on) is joined after they have run. A repeated section number is concatenated rather than reported as a duplicate. From version 5.518, an encoded word or trailing whitespace in such a boundary also goes unflagged, although multipart_boundary() decodes or strips it.
A remote sender can make MIME::Parser split a message on a different boundary than other mail readers, hiding an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-116265View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.