CVE-2026-116266

MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous. The multipart_boundary() method decodes RFC 2047 encoded words anywhere in the boundary, but the ambiguity check only fires when the whole value is one encoded word. A boundary such as abc=?us-ascii?Q?def?= is used as abcdef, and ambiguous_content() returns false. Encoded words are not allowed in parameters, so other mail readers split the message on the literal value. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.

• CWE-436

• https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes

Published

Oct 28, 2026

Last Modified

Nov 5, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116260A weakness has been identified in libimobiledevice up to 1.4…7.3
• CVE-2026-116261A security vulnerability has been detected in libimobiledevi…3.5
• CVE-2026-116262A vulnerability was detected in libimobiledevice up to 1.4.0…5.4
• CVE-2026-116263A flaw has been found in HaschekSolutions PictShare up to 3.…4.6
• CVE-2026-116264MIME::Field::ParamVal versions before 5.521 for Perl allow o…5.3
• CVE-2026-116265MIME::Field::ParamVal versions before 5.521 for Perl do not …5.3
• CVE-2026-116267MIME::Parser versions before 5.521 for Perl allow memory exh…7.5
• CVE-2026-116268MIME::Field::ParamVal versions before 5.521 for Perl allow C…7.5
• CVE-2026-116269MIME::Field::ParamVal versions before 5.521 for Perl turn an…5.3
• CVE-2026-116270MIME::Words versions before 5.521 for Perl allow memory exha…7.5
• CVE-2026-116271MIME::Parser::FileUnder versions before 5.521 for Perl reuse…7
• CVE-2026-116272MIME::Field::ParamVal versions before 5.521 for Perl do not …5.3