Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded part without marking the parse as ambiguous.
Mail readers that skip the invalid parameter still find the boundary. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Perl | Mime::field::paramval | 100% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Vendor Solution
Upgrade to MIME-tools 5.521 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes |
|
Wed, 28 Oct 2026 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Perl
Perl mime::field::paramval |
|
| Vendors & Products |
Perl
Perl mime::field::paramval |
Wed, 28 Oct 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded part without marking the parse as ambiguous. Mail readers that skip the invalid parameter still find the boundary. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it. | |
| Title | MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary | |
| Weaknesses | CWE-436 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-28T17:31:52.187Z
Reserved: 2026-10-25T18:05:02.235Z
Link: CVE-2026-116264
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-28T18:17:12.797
Modified: 2026-10-28T18:17:12.797
Link: CVE-2026-116264
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-28T22:10:22Z