CVE-2026-116272

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written boundary((c))="A" or boundary(\))="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it. Readers that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.

• CWE-436

• https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes

Published

Oct 28, 2026

Last Modified

Nov 5, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116266MIME::Head versions from 5.518 before 5.521 for Perl decode …5.3
• CVE-2026-116267MIME::Parser versions before 5.521 for Perl allow memory exh…7.5
• CVE-2026-116268MIME::Field::ParamVal versions before 5.521 for Perl allow C…7.5
• CVE-2026-116269MIME::Field::ParamVal versions before 5.521 for Perl turn an…5.3
• CVE-2026-116270MIME::Words versions before 5.521 for Perl allow memory exha…7.5
• CVE-2026-116271MIME::Parser::FileUnder versions before 5.521 for Perl reuse…7
• CVE-2026-116273MIME::Parser versions before 5.521 for Perl set no limit on …7.5
• CVE-2026-116274A vulnerability has been found in JIZHICMS up to 2.5.6. This…4.3
• CVE-2026-116275A vulnerability was found in AllenAI AllenNLP up to 2.10.1. …6.3
• CVE-2026-11628Use after free in Ozone in Google Chrome prior to 149.0.7827…6.8
• CVE-2026-116280A vulnerability was determined in Kameleo up to 5.0.1.26. Af…5.5
• CVE-2026-116281A vulnerability was identified in Kameleo up to 5.0.1.26. Af…3.3