CVE-2026-116268: MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters
MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.
The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.
A 40 KB header takes about 7 seconds to parse once.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MIME-toolsto a version that resolves this vulnerability.Fixed in 5.521
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems using MIME::Field::ParamVal versions before 5.521 to parse MIME Content-Type or Content-Disposition header parameters are exposed when they process headers that an attacker can influence.
What does an attacker need to supply to trigger the excessive CPU use?
The attacker needs a header parameter containing one or more opening parentheses without a closing parenthesis. Each opening parenthesis causes the parser to scan to the end of the header, and repeated attribute lookups can parse the field multiple times.
How can I determine whether an installation is affected?
Check the installed MIME::Field::ParamVal version. Versions before 5.521 are affected; version 5.521 is the referenced fixed release.
What operational impact has been observed?
A 40 KB malformed header was reported to take about 7 seconds to parse once. The impact can increase because the same field may be parsed again for multiple attribute lookups on a MIME entity.