MIME Parsing Vulnerability in Perl from DSKOLL
CVE-2026-116265

Currently unrated

Key Information:

Vendor

DSKOLL

Status
Vendor
CVE Published:
28 October 2026

What is CVE-2026-116265?

The MIME::Field::ParamVal module in Perl versions prior to 5.521 has a critical flaw that allows for ambiguous multipart boundaries due to inadequate handling of RFC 2231 encoding. This oversight enables a remote sender to manipulate message parsing, potentially leading to hidden attachments that some mail filters may misinterpret. Specifically, the vulnerability arises from the failure to detect duplicate boundary segments and improper processing of encoded words or trailing whitespace, which can result in unintended behavior by mail clients.

References

https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.