Live › vulnerability › CVE-2026-116265
Go to dashboardMIME::Field::ParamVal before 5.521 does not flag multipart boundaries split into RFC 2231 continuation sections, so the ambiguity checks miss them. A remote sender can make MIME::Parser split a message on a different boundary than other mail readers, hiding an attachment from filters that rely on ambiguous_content().
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Teams that parse inbound email in Perl with MIME::Parser and rely on ambiguous_content() to block or inspect attachments are exposed. Systems that do not parse untrusted multipart mail with this module, or that do not depend on ambiguous_content() for filtering, have less reason to act.
No product ranges from the sources yet.
perl -MMIME::Field::ParamVal -e 'print $MIME::Field::ParamVal::VERSION' (the sources do not name the exact module path)ambiguous_content() from MIME::Parser to filter inbound mail5.521 or later (the sources name this as the first fixed version)5.518 also have an unflagged encoded-word or trailing-whitespace variant; the sources do not give a separate fixed version for that caseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations.
The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections (boundary0=, boundary1= and so on) is joined after they have run. A repeated section number is concatenated rather than reported as a duplicate. From version 5.518, an encoded word or trailing whitespace in such a boundary also goes unflagged, although multipart_boundary() decodes or strips it.
A remote sender can make MIME::Parser split a message on a different boundary than other mail readers, hiding an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.
This page as .md · .json · in your agent: get_signal("CVE-2026-116265")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.