CVE-2026-116272: MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment
MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.
A parameter written boundary((c))="A" or boundary(\))="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it.
Readers that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguouscontent() while the recipient's mail client shows it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MIME-toolsto a version that resolves this vulnerability.Fixed in 5.521
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Mail-processing systems using affected MIME::Field::ParamVal versions and relying on MIME::Parser's ambiguous_content() result to detect ambiguous multipart boundaries are exposed. The practical impact is a mismatch between a filtering component and a recipient mail client that skips RFC 5322 comments.
What does an attacker need to exploit it?
An attacker needs to be able to send a crafted MIME message containing a boundary parameter whose name includes a nested comment, such as boundary((c))="A" or boundary(\))="A", along with another boundary parameter. The parser can then use the second boundary while a comment-skipping reader uses the first.
What should be done if patching is possible?
Upgrade MIME::Field::ParamVal to version 5.521 or later. Versions before 5.521 do not correctly treat the crafted parameter name as boundary when checking for duplicates.
How can I look for potentially affected messages?
Inspect multipart message headers for multiple boundary-like parameters where one parameter name contains comments or escaped closing parentheses, such as boundary((c)) or boundary(\)). Such messages may evade duplicate-boundary detection while being interpreted differently by mail clients.