CVE-2026-116265: MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations

Q: Who is exposed to this issue?

Systems using MIME::Field::ParamVal before 5.521 in MIME message-processing paths are exposed when they receive attacker-controlled multipart email. The described impact is most relevant to mail filters that rely on ambiguous_content() before allowing or inspecting attachments.

Q: What does an attacker need to do to exploit it?

An attacker must send a multipart message whose boundary is expressed through RFC 2231 continuation parameters, such as boundary*0= and boundary*1=. They can exploit duplicated continuation section numbers, and in versions from 5.518, encoded words or trailing whitespace, to create a boundary interpretation mismatch between MIME::Parser and other mail readers.

Q: What can be done if upgrading is not immediately possible?

Do not rely on ambiguous_content() alone to determine whether a multipart message is safe to filter or deliver. Treat multipart messages with RFC 2231-split boundary parameters, especially duplicated section numbers or boundaries containing encoded words or trailing whitespace, as requiring additional handling or rejection.

Q: How can I determine whether my deployment is affected?

Check whether the installed MIME::Field::ParamVal version is earlier than 5.521. Review whether MIME::Parser is used to process untrusted email and whether attachment filtering or message acceptance decisions depend on ambiguous_content().

Published Oct 28, 2026

Updated

MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations.

The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections (boundary0=, boundary1= and so on) is joined after they have run. A repeated section number is concatenated rather than reported as a duplicate. From version 5.518, an encoded word or trailing whitespace in such a boundary also goes unflagged, although multipartboundary() decodes or strips it.

A remote sender can make MIME::Parser split a message on a different boundary than other mail readers, hiding an attachment from a filter that relies on ambiguouscontent() while the recipient's mail client shows it.

Affected Software

1 affected component

cpan/mime-tools<5.521

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MIME-tools to a version that resolves this vulnerability.
Fixed in 5.521

Event History

Oct 28, 2026

CVE Published

via MITRE·05:32 PM

Data Sourced

via MITRE·05:32 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Systems using MIME::Field::ParamVal before 5.521 in MIME message-processing paths are exposed when they receive attacker-controlled multipart email. The described impact is most relevant to mail filters that rely on ambiguous_content() before allowing or inspecting attachments.

What does an attacker need to do to exploit it?

An attacker must send a multipart message whose boundary is expressed through RFC 2231 continuation parameters, such as boundary*0= and boundary*1=. They can exploit duplicated continuation section numbers, and in versions from 5.518, encoded words or trailing whitespace, to create a boundary interpretation mismatch between MIME::Parser and other mail readers.

What can be done if upgrading is not immediately possible?

Do not rely on ambiguous_content() alone to determine whether a multipart message is safe to filter or deliver. Treat multipart messages with RFC 2231-split boundary parameters, especially duplicated section numbers or boundaries containing encoded words or trailing whitespace, as requiring additional handling or rejection.

How can I determine whether my deployment is affected?

Check whether the installed MIME::Field::ParamVal version is earlier than 5.521. Review whether MIME::Parser is used to process untrusted email and whether attachment filtering or message acceptance decisions depend on ambiguous_content().

CVE-2026-116265: MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

What can be done if upgrading is not immediately possible?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

What can be done if upgrading is not immediately possible?

How can I determine whether my deployment is affected?