---
id: "CVE-2026-116268"
kind: "vulnerability"
aliases: ["CVE-2026-116268"]
title: "Perl MIME::Field::ParamVal: unclosed comments cause CPU exhaustion during parsing"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["email-parsing", "mime", "package", "perl", "self-hosted"]
not_affected_if: ["no-untrusted-mime-input", "version-5.521-or-later"]
published_at: "2026-10-28T18:17:13+00:00"
first_seen_at: "2026-10-28T18:34:33+00:00"
updated_at: "2026-10-28T18:35:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116268", "first_seen_at": "2026-10-28T18:34:33+00:00"}]
---

# Perl MIME::Field::ParamVal: unclosed comments cause CPU exhaustion during parsing

MIME::Field::ParamVal, a Perl module for parsing MIME header parameters, scans each unclosed comment to the end of the header, so parsing takes time quadratic in header length. A crafted message with a long header stalls the parser and ties up CPU; the sources report about 7 seconds for a 40 KB header.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `perl -MMIME::Field::ParamVal -e 'print $MIME::Field::ParamVal::VERSION'` to read the installed version
- Check the lockfile or `cpanm --info MIME::Field::ParamVal` for the resolved version

## Fix

- Upgrade MIME::Field::ParamVal to `5.521` or later
- Cap incoming header size before parsing as a short-term mitigation (unknown if the sources give a limit)

## Timeline

- 2026-10-28T18:34:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116268

## From the sources

MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.

The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.

A 40 KB header takes about 7 seconds to parse once.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_