https://seclists.org/oss-sec/2026/q4/428: MIME-tools versions befo5.521 for Perl (10 CVEs)
Published Oct 28, 2026
·Updated
Affected Software
1 affected component
cpan/MIME-tools<5.521
Check the installed MIME-tools version and the MIME modules in use. MIME::Field::ParamVal, MIME::Parser, MIME::Words, and MIME::Parser::FileUnder are affected before version 5.521; MIME::Head is affected from 5.518 through versions before 5.521.
Affected versions can consume excessive memory when parsing a truncated, deeply nested message or when decode_mimewords processes repeated "=?" sequences. They can also consume excessive CPU while processing unclosed comments in header parameters.
Yes. A malformed Content-Type parameter can hide subsequent parameters, including a multipart boundary, and ambiguous boundaries expressed through RFC 2231 continuations may not be flagged. MIME::Head versions 5.518 before 5.521 can also decode a partly encoded multipart boundary without marking the parse as ambiguous.
The reported MIME::Parser::FileUnder issue involves reuse of a pre-created output directory and following symlinks within that directory. The available information specifically describes this as allowing a local condition involving that directory.