MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.
A parameter written boundary((c))="A" or boundary(\))="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it.
Readers that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.
GHSA-hx8x-4mjr-grc3
MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter...
https://github.com/advisories/GHSA-hx8x-4mjr-grc3MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.
A parameter written boundary((c))="A" or boundary())="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it.
Readers that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.
Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116272",
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"dateUpdated": "2026-10-28T17:34:25.862Z",
"dateReserved": "2026-10-25T18:05:02.236Z",
"datePublished": "2026-10-28T17:34:25.862Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec",
"dateUpdated": "2026-10-28T17:34:25.862Z"
},
"title": "MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment",
"descriptions": [
{
"lang": "en",
"value": "MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.\n\nA parameter written boundary((c))=\"A\" or boundary(\\))=\"A\" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it.\n\nReaders that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it."
}
],
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"packageName": "MIME-tools",
"modules": [
"MIME::Field::ParamVal"
],
"programFiles": [
"lib/MIME/Field/ParamVal.pm"
],
"programRoutines": [
{
"name": "MIME::Field::ParamVal::parse_params"
}
],
"repo": "https://salsa.debian.org/dskoll/mime-tools",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "5.521"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-436 Interpretation Conflict",
"cweId": "CWE-436",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes",
"tags": [
"release-notes"
]
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to MIME-tools 5.521 or later."
}
]
}
}
}