{"id":"CVE-2026-116268","kind":"vulnerability","aliases":["CVE-2026-116268"],"related":[],"title":"Perl MIME::Field::ParamVal: unclosed comments cause CPU exhaustion during parsing","description":"MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.\n\nThe comment pattern used to parse Content-Type and Content-Disposition parameters scans from each \"(\" to the next \")\". In a field with no \")\", every \"(\" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.\n\nA 40 KB header takes about 7 seconds to parse once.","summary":"MIME::Field::ParamVal, a Perl module for parsing MIME header parameters, scans each unclosed comment to the end of the header, so parsing takes time quadratic in header length. A crafted message with a long header stalls the parser and ties up CPU; the sources report about 7 seconds for a 40 KB header.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email-parsing","mime","package","perl","self-hosted"],"not_affected_if":["no-untrusted-mime-input","version-5.521-or-later"],"how_to_check":"- Run `perl -MMIME::Field::ParamVal -e 'print $MIME::Field::ParamVal::VERSION'` to read the installed version\n- Check the lockfile or `cpanm --info MIME::Field::ParamVal` for the resolved version","fix":"- Upgrade MIME::Field::ParamVal to `5.521` or later\n- Cap incoming header size before parsing as a short-term mitigation (unknown if the sources give a limit)","status":"open","published_at":"2026-10-28T18:17:13+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:35:27+00:00","updated_at":"2026-10-28T18:35:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T18:35:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MIME::Field::ParamVal to `5.521` or later\n- Cap incoming header size before parsing as a short-term mitigation (unknown if the sources give a limit)","reach":"unknown","title":"Perl MIME::Field::ParamVal: unclosed comments cause CPU exhaustion during parsing","impact":"low","summary":"MIME::Field::ParamVal, a Perl module for parsing MIME header parameters, scans each unclosed comment to the end of the header, so parsing takes time quadratic in header length. A crafted message with a long header stalls the parser and ties up CPU; the sources report about 7 seconds for a 40 KB header.","category":"package","nicknames":[],"who_cares":["perl","mime","email-parsing","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker stalls parser and exhausts CPU with one crafted header","analyst_note":"Check the NVD entry and the upstream CPAN change log for the exact affected range and any header size limit; severity and attacker reach are not stated in the sources.","how_to_check":"- Run `perl -MMIME::Field::ParamVal -e 'print $MIME::Field::ParamVal::VERSION'` to read the installed version\n- Check the lockfile or `cpanm --info MIME::Field::ParamVal` for the resolved version","needs_analyst":true,"not_affected_if":["version-5.521-or-later","no-untrusted-mime-input"],"who_is_affected":"Applications written in Perl that parse untrusted MIME messages or Content-Type and Content-Disposition headers with this module, such as mail handlers, upload processors or email-to-web gateways. Systems that never parse attacker-supplied MIME data, or that run a version at or above 5.521, are not exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000671,"input_tokens":3392,"output_tokens":663,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116268':14A,17A '-2026':13A,16A '40':78B,157C '5.521':86C '7':74B,162C 'allow':89C 'attribut':149C 'caus':7A 'comment':6A,41B,94C,99C 'content':105C,109C 'content-disposit':108C 'content-typ':104C 'cpu':8A,69B,90C 'craft':57B 'cve':12A,15A 'disposit':110C 'email':19B 'email-pars':18B 'end':44B,127C 'entiti':155C 'everi':123C 'exhaust':9A,91C 'fail':132C 'field':3A,28B,82C,120C,143C 'header':36B,47B,54B,62B,80B,96C,130C,140C,159C 'host':26B 'kb':79B,158C 'length':55B,141C 'long':61B 'lookup':150C 'messag':58B 'mime':2A,21B,27B,35B,81C,154C 'modul':32B 'next':117C 'packag':22B 'paramet':37B,97C,111C 'paramv':4A,29B,83C 'pars':11A,20B,34B,49B,103C,134C,145C,165C 'parser':65B 'pattern':100C 'per':153C 'perl':1A,23B,31B,88C 'quadrat':52B,137C 'report':72B 'scan':38B,112C,124C 'second':75B,163C 'self':25B 'self-host':24B 'sever':151C 'sourc':71B 'stall':63B 'take':50B,135C,160C 'tie':67B 'time':51B,136C,152C 'type':106C 'unclos':5A,40B,93C 'use':101C 'version':84C 'via':92C","nicknames":[],"mitigations":[],"who_affected":"Applications written in Perl that parse untrusted MIME messages or Content-Type and Content-Disposition headers with this module, such as mail handlers, upload processors or email-to-web gateways. Systems that never parse attacker-supplied MIME data, or that run a version at or above 5.521, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116268","severity":null,"published_at":"2026-10-28T18:17:13+00:00","modified_at":"2026-10-28T18:17:13+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}