Live › vulnerability › CVE-2026-116272
Go to dashboardMIME::Field::ParamVal in Perl versions before 5.521 fails to detect a duplicate boundary parameter when its name contains a nested comment, so the parser stores it under a different literal name. A remote sender can use this mismatch to hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client still shows it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Teams that run Perl mail processing with MIME::Parser and rely on ambiguous_content() to block messages with duplicate boundary parameters. Systems that do not parse inbound MIME with this module, or that use other content filtering, have less exposure. The sources do not say which other readers or products are affected.
No product ranges from the sources yet.
perl -MMIME::Field::ParamVal -e 'print $MIME::Field::ParamVal::VERSION' (unknown whether the sources give a different command)ambiguous_content() from MIME::Parser5.521 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.
A parameter written boundary((c))="A" or boundary())="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it.
Readers that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.
This page as .md · .json · in your agent: get_signal("CVE-2026-116272")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.