{"id":"CVE-2026-116265","kind":"vulnerability","aliases":["CVE-2026-116265"],"related":[],"title":"Perl MIME::Field::ParamVal: ambiguous RFC 2231 multipart boundaries go unflagged","description":"MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations.\n\nThe boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections (boundary*0=, boundary*1= and so on) is joined after they have run. A repeated section number is concatenated rather than reported as a duplicate. From version 5.518, an encoded word or trailing whitespace in such a boundary also goes unflagged, although multipart_boundary() decodes or strips it.\n\nA remote sender can make MIME::Parser split a message on a different boundary than other mail readers, hiding an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.","summary":"MIME::Field::ParamVal before 5.521 does not flag multipart boundaries split into RFC 2231 continuation sections, so the ambiguity checks miss them. A remote sender can make MIME::Parser split a message on a different boundary than other mail readers, hiding an attachment from filters that rely on ambiguous_content().","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mail-filtering","mime-parser","package","perl"],"not_affected_if":["no-untrusted-mail-parsing"],"how_to_check":"- Check the installed MIME::Field::ParamVal version with `perl -MMIME::Field::ParamVal -e 'print $MIME::Field::ParamVal::VERSION'` (the sources do not name the exact module path)\n- Look for code that calls `ambiguous_content()` from MIME::Parser to filter inbound mail","fix":"- Upgrade MIME::Field::ParamVal to `5.521` or later (the sources name this as the first fixed version)\n- Note: versions from `5.518` also have an unflagged encoded-word or trailing-whitespace variant; the sources do not give a separate fixed version for that case","status":"open","published_at":"2026-10-28T18:17:12+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:35:32+00:00","updated_at":"2026-10-28T18:35:32+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-28T18:35:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MIME::Field::ParamVal to `5.521` or later (the sources name this as the first fixed version)\n- Note: versions from `5.518` also have an unflagged encoded-word or trailing-whitespace variant; the sources do not give a separate fixed version for that case","reach":"network","title":"Perl MIME::Field::ParamVal: ambiguous RFC 2231 multipart boundaries go unflagged","impact":"low","summary":"MIME::Field::ParamVal before 5.521 does not flag multipart boundaries split into RFC 2231 continuation sections, so the ambiguity checks miss them. A remote sender can make MIME::Parser split a message on a different boundary than other mail readers, hiding an attachment from filters that rely on ambiguous_content().","category":"package","nicknames":[],"who_cares":["perl","mail-filtering","mime-parser"],"confidence":0.5,"needs_auth":"no","worst_case":"Attachments hidden from a mail filter while the recipient's client shows them","analyst_note":"Confirm the affected version range and the fixed version against the NVD entry and the upstream Perl distribution; the description mentions 5.518 as a second affected point, so check whether 5.521 fully covers it.","how_to_check":"- Check the installed MIME::Field::ParamVal version with `perl -MMIME::Field::ParamVal -e 'print $MIME::Field::ParamVal::VERSION'` (the sources do not name the exact module path)\n- Look for code that calls `ambiguous_content()` from MIME::Parser to filter inbound mail","needs_analyst":true,"not_affected_if":["no-untrusted-mail-parsing"],"who_is_affected":"Teams that parse inbound email in Perl with MIME::Parser and rely on ambiguous_content() to block or inspect attachments are exposed. Systems that do not parse untrusted multipart mail with this module, or that do not depend on ambiguous_content() for filtering, have less reason to act.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000711,"input_tokens":3483,"output_tokens":725,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116265':14A,17A '-2026':13A,16A '0':116C '1':118C '2231':7A,39B,94C,113C '5.518':142C '5.521':30B,81C 'also':153C 'although':156C 'ambigu':5A,44B,74B,88C,98C,190C 'attach':68B,183C 'boundari':9A,35B,61B,90C,97C,105C,109C,115C,117C,152C,158C,176C 'check':45B,99C 'client':197C 'concaten':133C 'content':75B,191C 'continu':40B,95C 'cve':12A,15A 'decod':159C 'differ':60B,175C 'duplic':139C 'encod':144C 'field':3A,27B,77C 'filter':20B,70B,186C 'flag':33B,86C 'go':10A 'goe':154C 'hide':66B,181C 'join':123C 'look':100C 'mail':19B,64B,179C,196C 'mail-filt':18B 'make':52B,167C 'messag':57B,172C 'mime':2A,22B,26B,53B,76C,168C 'mime-pars':21B 'miss':46B 'multipart':8A,34B,89C,157C 'number':131C 'packag':24B 'paramet':106C 'paramv':4A,28B,78C 'parser':23B,54B,169C 'perl':1A,25B,83C 'plain':104C 'rather':134C 'reader':65B,180C 'recipi':194C 'reli':72B,188C 'remot':49B,164C 'repeat':129C 'report':136C 'rfc':6A,38B,93C,112C 'run':127C 'section':41B,114C,130C 'sender':50B,165C 'show':198C 'split':36B,55B,110C,170C 'strip':161C 'trail':147C 'unflag':11A,155C 'version':79C,141C 'whitespac':148C 'word':145C 'written':91C","nicknames":[],"mitigations":[],"who_affected":"Teams that parse inbound email in Perl with MIME::Parser and rely on ambiguous_content() to block or inspect attachments are exposed. Systems that do not parse untrusted multipart mail with this module, or that do not depend on ambiguous_content() for filtering, have less reason to act.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116265","severity":null,"published_at":"2026-10-28T18:17:12+00:00","modified_at":"2026-10-28T18:17:12+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}