CVE-2026-116264 MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary.
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116264?
CVE-2026-116264 is a vulnerability, published on 28 Oct 2026.
Official description
MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary.
Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded part without marking the parse as ambiguous.
Mail readers that skip the invalid parameter still find the boundary. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.
Weakness: CWE-436
Which versions are affected by CVE-2026-116264?
How do I fix CVE-2026-116264?
No fix has been published for CVE-2026-116264 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116264 being exploited?
There is no known exploitation of CVE-2026-116264 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-116264, GHSA-8mr9-wfcj-h3rm, UBUNTU-CVE-2026-116264.