CVE-2026-116265

MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections (boundary*0=, boundary*1= and so on) is joined after they have run. A repeated section number is concatenated rather than reported as a duplicate. From version 5.518, an encoded word or trailing whitespace in such a boundary also goes unflagged, although multipart_boundary() decodes or strips it. A remote sender can make MIME::Parser split a message on a different boundary than other mail readers, hiding an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.

• CWE-436

• https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes

Published

Oct 28, 2026

Last Modified

Nov 5, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11626CleanWipe Removal Tool (macOS), prior to 16.0.0.65, may be s…5.4
• CVE-2026-116260A weakness has been identified in libimobiledevice up to 1.4…7.3
• CVE-2026-116261A security vulnerability has been detected in libimobiledevi…3.5
• CVE-2026-116262A vulnerability was detected in libimobiledevice up to 1.4.0…5.4
• CVE-2026-116263A flaw has been found in HaschekSolutions PictShare up to 3.…4.6
• CVE-2026-116264MIME::Field::ParamVal versions before 5.521 for Perl allow o…5.3
• CVE-2026-116266MIME::Head versions from 5.518 before 5.521 for Perl decode …5.3
• CVE-2026-116267MIME::Parser versions before 5.521 for Perl allow memory exh…7.5
• CVE-2026-116268MIME::Field::ParamVal versions before 5.521 for Perl allow C…7.5
• CVE-2026-116269MIME::Field::ParamVal versions before 5.521 for Perl turn an…5.3
• CVE-2026-116270MIME::Words versions before 5.521 for Perl allow memory exha…7.5
• CVE-2026-116271MIME::Parser::FileUnder versions before 5.521 for Perl reuse…7