CVE-2026-116264— MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary

Quick assessment

Affected

CVE-2026-116264

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 MIME::Field::ParamVal 模块在 5.521 版本之前存在漏洞：一个无效的 Content-Type 参数可以隐藏其后的所有参数，包括 multipart 的边界（boundary）。该模块在解析参数时，一旦遇到无法识别名称的参数（例如形如的参数，或名称中包含 8 位字节的参数），就会停止解析，并丢弃该参数之后的所有参数。如果边界参数恰好位于这些被丢弃的参数之中，MIME::Parser 会将整个 multipart 主体视为一个未解码的单一部分，且不会将此次解析标记为“歧义”（

AI Predicted 5.3 Difficulty: Moderate EPSS 0.18% · P7 Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
None	None	`< 5.521`	affected

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary

Source: CVE Program / CVE List V5

Vulnerability Description

MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded part without marking the parse as ambiguous. Mail readers that skip the invalid parameter still find the boundary. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

解释冲突

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	0 ~ 5.521	-

II. Public POCs for CVE-2026-116264

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116264

请登录查看更多情报信息。

Other References for CVE-2026-116264 (1)

https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes release-notes

https://www.cve.org/CVERecord?id=CVE-2026-116264

IV. Related Vulnerabilities

Same weakness: CWE-436