CVE-2026-116272: falha de média gravidade em MIME-tools
MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.2%
MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.
A parameter written boundary((c))="A" or boundary(\))="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it.
Readers that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
MIME-toolsCVEs relacionadas — MIME-tools
No mesmo produto, das mais perigosas para as menos.
CVE-2026-116273HIGHMIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustionEPSS 0.3%CVE-2026-116270HIGHMIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewordsEPSS 0.3%CVE-2026-116268HIGHMIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parametersEPSS 0.3%CVE-2026-116267HIGHMIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested messageEPSS 0.3%CVE-2026-116269MEDIUMMIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filenameEPSS 0.2%CVE-2026-116266MEDIUMMIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguousEPSS 0.2%