Live › vulnerability › CVE-2026-116264
Go to dashboardMIME::Field::ParamVal before 5.521 stops parsing Content-Type parameters at the first unreadable name, dropping the multipart boundary when it comes after. MIME::Parser then keeps the body as one undecoded part without flagging ambiguity, so a message can carry an attachment that a filter relying on ambiguous_content() does not see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Teams running Perl mail-processing code that uses MIME::Parser and MIME::Field::ParamVal to scan or filter inbound messages, where a filter decision depends on ambiguous_content(). Mail clients and systems that do not use this Perl module are not exposed through this flaw, and the sources do not say whether other MIME parsers share the behavior.
No product ranges from the sources yet.
perl -MMIME::Field::ParamVal -e 'print $MIME::Field::ParamVal::VERSION'ambiguous_content() on MIME::Parser results to decide whether to scan or block mail5.521 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary.
Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded part without marking the parse as ambiguous.
Mail readers that skip the invalid parameter still find the boundary. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.
This page as .md · .json · in your agent: get_signal("CVE-2026-116264")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.