MIME Field Parameter Processing Issue in Perl's MIME::Field::ParamVal
CVE-2026-116268

Currently unrated

Key Information:

Vendor

Perl

Status
Vendor
CVE Published:
28 October 2026

What is CVE-2026-116268?

A performance issue exists in Perl's MIME::Field::ParamVal, where improperly closed comments in header parameters can lead to significant CPU exhaustion. This occurs when the parsing function tries to locate matching parentheses in headers that lack a closing parenthesis, causing an exponential increase in processing time relative to header length. For instance, parsing a header of 40 KB can result in delays of around 7 seconds. Each attribute lookup triggers a re-evaluation of the field, compounding the inefficiency within MIME entities.

References

https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.