Parameter Parsing Flaw in MIME::Field::ParamVal Affects Perl Software

CVE-2026-116264

What is CVE-2026-116264?

A parameter parsing flaw in MIME::Field::ParamVal versions prior to 5.521 for Perl allows an invalid Content-Type parameter to obscure subsequent parameters, including the critical multipart boundary. When the parser encounters a malformed parameter, it ceases processing, leading to possible security risks where valid attachments can be concealed from email filters. This can enable remote actors to bypass security checks, resulting in unauthorized access to potentially harmful attachments. Mail clients that overlook the invalid parameters may continue to function normally, creating an environment where threats can evade detection.

References