{"id":"CVE-2026-116272","kind":"vulnerability","aliases":["CVE-2026-116272"],"related":[],"title":"Perl MIME::Field::ParamVal: duplicate boundary check lets mail hide attachments","description":"MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.\n\nA parameter written boundary((c))=\"A\" or boundary(\\))=\"A\" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it.\n\nReaders that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.","summary":"MIME::Field::ParamVal in Perl versions before 5.521 fails to detect a duplicate boundary parameter when its name contains a nested comment, so the parser stores it under a different literal name. A remote sender can use this mismatch to hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client still shows it.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mail-filtering","mime-parser","package","perl"],"not_affected_if":["no-ambiguous-content-filter","no-mime-parser"],"how_to_check":"- Check the installed MIME::Field::ParamVal version with `perl -MMIME::Field::ParamVal -e 'print $MIME::Field::ParamVal::VERSION'` (unknown whether the sources give a different command)\n- Check whether any mail filter code calls `ambiguous_content()` from MIME::Parser","fix":"- Upgrade MIME::Field::ParamVal to `5.521` or later","status":"open","published_at":"2026-10-28T18:17:13+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:35:23+00:00","updated_at":"2026-10-28T18:35:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T18:35:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MIME::Field::ParamVal to `5.521` or later","reach":"internet","title":"Perl MIME::Field::ParamVal: duplicate boundary check lets mail hide attachments","impact":"low","summary":"MIME::Field::ParamVal in Perl versions before 5.521 fails to detect a duplicate boundary parameter when its name contains a nested comment, so the parser stores it under a different literal name. A remote sender can use this mismatch to hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client still shows it.","category":"package","nicknames":[],"who_cares":["perl","mail-filtering","mime-parser"],"confidence":0.6,"needs_auth":"no","worst_case":"Hidden attachment passes a mail filter and reaches the recipient","analyst_note":"","how_to_check":"- Check the installed MIME::Field::ParamVal version with `perl -MMIME::Field::ParamVal -e 'print $MIME::Field::ParamVal::VERSION'` (unknown whether the sources give a different command)\n- Check whether any mail filter code calls `ambiguous_content()` from MIME::Parser","needs_analyst":false,"not_affected_if":["no-mime-parser","no-ambiguous-content-filter"],"who_is_affected":"Teams that run Perl mail processing with MIME::Parser and rely on ambiguous_content() to block messages with duplicate boundary parameters. Systems that do not parse inbound MIME with this module, or that use other content filtering, have less exposure. The sources do not say which other readers or products are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3412,"output_tokens":594,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116272':14A,17A '-2026':13A,16A '5.521':33B,90C '5322':150C 'allow':151C 'ambigu':75B,170C 'attach':11A,68B,163C 'boundari':6A,39B,98C,109C,113C,124C,127C,155C 'c':110C 'check':7A 'client':82B,177C 'comment':47B,105C,147C 'contain':44B,102C 'content':76B,171C 'cve':12A,15A 'detect':36B 'differ':55B 'duplic':5A,38B,97C,135C 'fail':34B 'field':3A,27B,86C 'filter':20B,71B,166C 'first':154C 'flag':95C 'hide':10A,66B,161C 'instead':156C 'let':8A 'liter':56B,119C 'mail':9A,19B,81B,176C 'mail-filt':18B 'messag':141C 'mime':2A,22B,26B,85C,137C 'mime-pars':21B 'mismatch':64B 'name':43B,57B,101C,120C 'nest':46B,104C 'packag':24B 'paramet':40B,99C,107C,128C 'paramv':4A,28B,87C 'parser':23B,50B,138C 'perl':1A,25B,30B,92C 'rather':121C 'reader':144C 'recipi':79B,174C 'reli':73B,168C 'remot':59B,158C 'report':132C 'rfc':149C 'second':126C 'sender':60B,159C 'show':84B,178C 'skip':146C 'split':139C 'still':83B 'store':51B,116C 'take':152C 'use':62B 'version':31B,88C 'whose':100C 'written':108C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Perl mail processing with MIME::Parser and rely on ambiguous_content() to block messages with duplicate boundary parameters. Systems that do not parse inbound MIME with this module, or that use other content filtering, have less exposure. The sources do not say which other readers or products are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116272","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116272","severity":null,"published_at":"2026-10-28T18:17:13+00:00","modified_at":"2026-10-28T18:17:13+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}