MIME::Head Vulnerability in Perl by DSKOLL

CVE-2026-116266

What is CVE-2026-116266?

The MIME::Head module in Perl versions prior to 5.521 has a vulnerability that affects how multipart boundaries are decoded. Specifically, the multipart_boundary() method improperly handles RFC 2047 encoded words embedded within the boundary, allowing them to be processed without raising an ambiguity flag. As a consequence, this could enable a remote attacker to exploit the email system by embedding encoded words in boundaries, leading to potential security risks such as the concealment of attachments from security filters, which typically rely on ambiguous content checks.

References