CVE-2026-116264 MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary
CVE-2026-116265 MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations
CVE-2026-116266 MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous
CVE-2026-116267 MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message
CVE-2026-116268 MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters
CVE-2026-116269 MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename
CVE-2026-116270 MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decodemimewords
CVE-2026-116271 MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes
CVE-2026-116272 MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment
CVE-2026-116273 MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion
======================================================================== CVE-2026-116264 CPAN Security Group ========================================================================
CVE ID: CVE-2026-116264
Distribution: MIME-tools Versions: before 5.521 MetaCPAN: https://metacpan.org/dist/MIME-tools VCS Repo: https://salsa.debian.org/dskoll/mime-tools
MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary
Description ----------- MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary.
Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded part without marking the parse as ambiguous.
Mail readers that skip the invalid parameter still find the boundary. A remote sender can hide an attachment from a filter that relies on ambiguouscontent() while the recipient's mail client shows it.
Problem types ------------- - CWE-436 Interpretation Conflict
Solutions --------- Upgrade to MIME-tools 5.521 or later.
References ---------- https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
======================================================================== CVE-2026-116265 CPAN Security Group ========================================================================
CVE ID: CVE-2026-116265
Distribution: MIME-tools Versions: before 5.521 MetaCPAN: https://metacpan.org/dist/MIME-tools VCS Repo: https://salsa.debian.org/dskoll/mime-tools
MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations
Description ----------- MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations.
The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections (boundary0=, boundary1= and so on) is joined after they have run. A repeated section number is concatenated rather than reported as a duplicate. From version 5.518, an encoded word or trailing whitespace in such a boundary also goes unflagged, although multipartboundary() decodes or strips it.
A remote sender can make MIME::Parser split a message on a different boundary than other mail readers, hiding an attachment from a filter that relies on ambiguouscontent() while the recipient's mail client shows it.
Problem types ------------- - CWE-436 Interpretation Conflict
Solutions --------- Upgrade to MIME-tools 5.521 or later.
References ---------- https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
======================================================================== CVE-2026-116266 CPAN Security Group ========================================================================
CVE ID: CVE-2026-116266
Distribution: MIME-tools Versions: from 5.518 before 5.521 MetaCPAN: https://metacpan.org/dist/MIME-tools VCS Repo: https://salsa.debian.org/dskoll/mime-tools
MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous
Description ----------- MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous.
The multipartboundary() method decodes RFC 2047 encoded words anywhere in the boundary, but the ambiguity check only fires when the whole value is one encoded word. A boundary such as abc=?us-ascii?Q?def?= is used as abcdef, and ambiguouscontent() returns false.
Encoded words are not allowed in parameters, so other mail readers split the message on the literal value. A remote sender can hide an attachment from a filter that relies on ambiguouscontent() while the recipient's mail client shows it.
Problem types ------------- - CWE-436 Interpretation Conflict
Solutions --------- Upgrade to MIME-tools 5.521 or later.
References ---------- https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
======================================================================== CVE-2026-116267 CPAN Security Group ========================================================================
CVE ID: CVE-2026-116267
Distribution: MIME-tools Versions: before 5.521 MetaCPAN: https://metacpan.org/dist/MIME-tools VCS Repo: https://salsa.debian.org/dskoll/mime-tools
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message
Description ----------- MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message.
Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth.
Problem types ------------- - CWE-407 Inefficient Algorithmic Complexity
Solutions --------- Upgrade to MIME-tools 5.521 or later.
References ---------- https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
======================================================================== CVE-2026-116268 CPAN Security Group ========================================================================
CVE ID: CVE-2026-116268
Distribution: MIME-tools Versions: before 5.521 MetaCPAN: https://metacpan.org/dist/MIME-tools VCS Repo: https://salsa.debian.org/dskoll/mime-tools
MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters
Description ----------- MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.
The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.
A 40 KB header takes about 7 seconds to parse once.
Problem types ------------- - CWE-1333 Inefficient Regular Expression Complexity
Solutions --------- Upgrade to MIME-tools 5.521 or later.
References ---------- https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
======================================================================== CVE-2026-116269 CPAN Security Group ========================================================================
CVE ID: CVE-2026-116269
Distribution: MIME-tools Versions: before 5.521 MetaCPAN: https://metacpan.org/dist/MIME-tools VCS Repo: https://salsa.debian.org/dskoll/mime-tools
MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename
Description ----------- MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename.
A parameter such as filename=utf-8'en-US'payload.exe is converted to an encoded word with the language tag appended to the charset. The decoder strips the language suffix only when it is a single word, so it cannot resolve the charset UTF-8EN-US and returns an empty string. The recommendedfilename() method returns that empty string rather than falling back to the name parameter.
Other mail readers return payload.exe. A remote sender can get an attachment past a policy that checks file extensions on the recommended filename.
Problem types ------------- - CWE-436 Interpretation Conflict
Solutions --------- Upgrade to MIME-tools 5.521 or later.
References ---------- https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
======================================================================== CVE-2026-116270 CPAN Security Group ========================================================================
CVE ID: CVE-2026-116270
Distribution: MIME-tools Versions: before 5.521 MetaCPAN: https://metacpan.org/dist/MIME-tools VCS Repo: https://salsa.debian.org/dskoll/mime-tools
MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decodemimewords
Description ----------- MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decodemimewords.
For each "=?" that does not start a complete encoded word, decodemimewords appends an error message containing the whole input string to $@. A boundary of 8,000 "=?" pairs (16,000 bytes) adds 8,000 copies of itself to $@, about 128 MB.
From version 5.518, MIME::Parser decodes every multipart boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type header.
Problem types ------------- - CWE-407 Inefficient Algorithmic Complexity
Solutions --------- Upgrade to MIME-tools 5.521 or later.
References ---------- https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
======================================================================== CVE-2026-116271 CPAN Security Group ========================================================================
CVE ID: CVE-2026-116271
Distribution: MIME-tools Versions: before 5.521 MetaCPAN: https://metacpan.org/dist/MIME-tools VCS Repo: https://salsa.debian.org/dskoll/mime-tools
MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes
Description ----------- MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.
Each message is written to a directory named msg-<time>-<pid>-<n> under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.
When the output base is writable by other users, as with outputunder("/tmp"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.
Problem types ------------- - CWE-59 Improper Link Resolution Before File Access ('Link Following')
Solutions --------- Upgrade to MIME-tools 5.521 or later.
References ---------- https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
======================================================================== CVE-2026-116272 CPAN Security Group ========================================================================
CVE ID: CVE-2026-116272
Distribution: MIME-tools Versions: before 5.521 MetaCPAN: https://metacpan.org/dist/MIME-tools VCS Repo: https://salsa.debian.org/dskoll/mime-tools
MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment
Description ----------- MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.
A parameter written boundary((c))="A" or boundary(\))="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it.
Readers that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguouscontent() while the recipient's mail client shows it.
Problem types ------------- - CWE-436 Interpretation Conflict
Solutions --------- Upgrade to MIME-tools 5.521 or later.
References ---------- https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
======================================================================== CVE-2026-116273 CPAN Security Group ========================================================================
CVE ID: CVE-2026-116273
Distribution: MIME-tools Versions: before 5.521 MetaCPAN: https://metacpan.org/dist/MIME-tools VCS Repo: https://salsa.debian.org/dskoll/mime-tools
MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion
Description ----------- MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion.
The maxparts option defaulted to -1, which disables the limit, so a parser created with default settings builds an entity for every part however many a message has.
Version 5.521 sets maxparts to 1000 and maxdepth to 64 by default. Setting either to -1 still removes the limit.
Problem types ------------- - CWE-1188 Initialization of a Resource with an Insecure Default - CWE-770 Allocation of Resources Without Limits or Throttling
Solutions --------- Upgrade to MIME-tools 5.521 or later.
References ---------- https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations.
The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections (boundary0=, boundary1= and so on) is joined after they have run. A repeated section number is concatenated rather than reported as a duplicate. From version 5.518, an encoded word or trailing whitespace in such a boundary also goes unflagged, although multipartboundary() decodes or strips it.
A remote sender can make MIME::Parser split a message on a different boundary than other mail readers, hiding an attachment from a filter that relies on ambiguouscontent() while the recipient's mail client shows it.