{"id":"CVE-2026-116268","aliases":["DEBIAN-CVE-2026-116268","EUVD-2026-112300","GHSA-cgxv-575f-wxjm","UBUNTU-CVE-2026-116268","openSUSE-SU-2026:12347-1","openSUSE-SU-2026:22226-1"],"status":"published","title":"MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters","description":"MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.\n\nThe comment pattern used to parse Content-Type and Content-Disposition parameters scans from each \"(\" to the next \")\". In a field with no \")\", every \"(\" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.\n\nA 40 KB header takes about 7 seconds to parse once.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00292,"percentile":0.22021,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2026-10-28T17:33:04Z","modified":"2026-11-05T21:34:42Z","fixes":[{"ecosystem":"Debian:14","package":"libmime-tools-perl","fixed_in":["5.522-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.510-1","5.510-2","5.510-3","5.512-1","5.513-1","5.514-1","5.515-1","5.517-1","5.518-1","5.519-1","5.520-1","5.522-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.515-1","5.517-1","5.518-1","5.519-1","5.520-1","5.522-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.522-1"}]}],"versions":["5.515-1","5.517-1","5.518-1","5.519-1","5.520-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.503-1","5.504-1","5.505-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.505-1","5.507-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.508-1","5.509-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.509-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.509-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.510-3","5.512-1","5.513-1","5.514-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.517-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.515-1","5.517-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-MIME-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.522.0-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-MIME-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.522.0-bp160.1.1"}]}],"bundled":10}],"references":[{"url":"https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes","tags":["release-notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116268"},{"url":"https://github.com/advisories/GHSA-cgxv-575f-wxjm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-116268","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-116268","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116268","tags":["report"]},{"url":"https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116273","tags":["web"]},{"url":"https://bugzilla.suse.com/1288714","tags":["report"]},{"url":"https://bugzilla.suse.com/1288715","tags":["report"]},{"url":"https://bugzilla.suse.com/1288716","tags":["report"]},{"url":"https://bugzilla.suse.com/1288717","tags":["report"]},{"url":"https://bugzilla.suse.com/1288718","tags":["report"]},{"url":"https://bugzilla.suse.com/1288719","tags":["report"]},{"url":"https://bugzilla.suse.com/1288720","tags":["report"]},{"url":"https://bugzilla.suse.com/1288721","tags":["report"]},{"url":"https://bugzilla.suse.com/1288722","tags":["report"]},{"url":"https://bugzilla.suse.com/1288723","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-116268","title":"MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters","description":"MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.\n\nThe comment pattern used to parse Content-Type and Content-Disposition parameters scans from each \"(\" to the next \")\". In a field with no \")\", every \"(\" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.\n\nA 40 KB header takes about 7 seconds to parse once.","status":"published","published":"2026-10-28T17:33:04.336Z","modified":"2026-11-05T20:30:45.017Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1333"],"updated_at":"2026-11-05T21:25:05.838392Z"}],"euvd":[{"id":"EUVD-2026-112300","description":"MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.\n\nThe comment pattern used to parse Content-Type and Content-Disposition parameters scans from each \"(\" to the next \")\". In a field with no \")\", every \"(\" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.\n\nA 40 KB header takes about 7 seconds to parse once.","status":"published","published":"2026-10-28T17:33:04Z","modified":"2026-11-05T20:30:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T21:01:57.572849Z"}],"ghsa":[{"id":"GHSA-cgxv-575f-wxjm","title":"MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments...","description":"MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.\n\nThe comment pattern used to parse Content-Type and Content-Disposition parameters scans from each \"(\" to the next \")\". In a field with no \")\", every \"(\" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.\n\nA 40 KB header takes about 7 seconds to parse once.","status":"published","published":"2026-10-28T18:32:12Z","modified":"2026-11-05T21:34:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-05T21:56:36.974002Z"}],"nvd":[{"id":"CVE-2026-116268","description":"MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.\n\nThe comment pattern used to parse Content-Type and Content-Disposition parameters scans from each \"(\" to the next \")\". In a field with no \")\", every \"(\" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.\n\nA 40 KB header takes about 7 seconds to parse once.","status":"published","published":"2026-10-28T18:17:13.25Z","modified":"2026-11-05T21:18:38.34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-05T23:57:22.237283Z"}],"osv":[{"id":"DEBIAN-CVE-2026-116268","description":"MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.  The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each \"(\" to the next \")\". In a field with no \")\", every \"(\" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.  A 40 KB header takes about 7 seconds to parse once.","status":"published","published":"2026-10-28T18:17:13.25Z","modified":"2026-11-06T10:04:36.051670187Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"UBUNTU-CVE-2026-116268","description":"MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each \"(\" to the next \")\". In a field with no \")\", every \"(\" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity. A 40 KB header takes about 7 seconds to parse once.","status":"published","published":"2026-10-28T18:17:00Z","modified":"2026-11-07T01:45:05.354999431Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-07T01:57:16.198641Z"},{"id":"openSUSE-SU-2026:12347-1","title":"perl-MIME-tools-5.522.0-1.1 on GA media","description":"These are all security issues fixed in the perl-MIME-tools-5.522.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-31T18:00:08.38815676Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22226-1","title":"Security update for perl-MIME-tools","description":"This update for perl-MIME-tools fixes the following issues:\n\nChanges in perl-MIME-tools:\n\n- updated to 5.522.0 (5.522)\n  * 5.522\n\t* VERSION 5.522 RELEASED\n\t* Many security issues were addressed (see the following ten CVEs)\n\t  Issues were brought to my attention, and patches supplied, by the\n\t  CPANSec security group.\n\t* parse_params: flag a parameter list that could not be parsed\n\t  Detect additional ambiguous parse situations when parameter\n\t  names contain illegal characters.  Fixes:\n\t  CVE-2026-116264 invalid parameter hides boundary/filename. bsc#1288723\n\t* parse_params: check the boundary after RFC 2231 reassembly\n\t  Another ambiguous-parse case was missed (trailing space after\n\t  boundary was not detected for RFC-2231-encoded boundaries.)  Fixes:\n\t  CVE-2026-116265 RFC 2231 boundary skips ambiguity checks. bsc#1288722\n\t* parse_params: Stricter checking for encoded boundaries; earlier\n\t  versions would miss some cases.  Fixes:\n\t  CVE-2026-116266 boundary changed by decoding not flagged. bsc#1288721\n\t* Cap the indentation levels in the Results: structure.  Otherwise,\n\t  specially-crafted messages could consume large amounts of memory.\n\t  Fixes: CVE-2026-116267 indent stored per message per level bsc#1288720\n\t* parse_params: stop a comment match at the next parenthesis.\n\t  Otherwise, specially-crafted messages could cause the regex\n\t  back-tracker to consume large amounts of CPU time.  Note that\n\t  MIME::Parser does not correctly parse ((nested comments)) and\n\t  has never done so.  Fixes:\n\t  CVE-2026-116268 unclosed \"(\" comments backtrack CPU exhaustion. bsc#1288719\n\t* parse_params: re-encode filename* values without charset tricks\n\t  Specially-crafted messages could trick recommended_filename()\n\t  into returning an empty string instead of a plausible filename.\n\t  Fixes: CVE-2026-116269 RFC 2231 language tag empties filename. bsc#1288718\n\t* decode_mimewords: do not copy the input into each error.  Otherwise,\n\t  specially-crafted messages could consume large amounts of memory.\n\t  Fixes: CVE-2026-116270 each bad \"=?\" copies the input into $@. bsc#1288717\n\t* FileUnder: do not reuse an existing generated directory.  Otherwise,\n\t  attackers might be able to use symbolic links to get files created\n\t  in unexpected locations.  Fixes:\n\t  CVE-2026-116271 FileUnder reuses a pre-created directory. bsc#1288716\n\t* parse_params: flag comments other readers do not skip\n\t  Specially-crafted messages could create ambiguous messages without\n\t  setting the ambiguous_parse flag.  Fixes:\n\t  CVE-2026-116272  comment hides a duplicate boundary. bsc#1288715\n\t* Call whine() rather than error() if max_parts or max_depth is\n\t  exceeded during a parse.  This lets us return undef rather than\n\t  throwing an exception if ignore_errors() is set to 0.\n\t* Change to defaults: max_parts is now set to 1000 and max_depth\n\t  to 64 rather than being unlimited.  This should not affect most\n\t  real-world uses of MIME::tools, but you may need to increase\n\t  these values or set them to -1 (unlimited) if you run into trouble.\n\t      ***** NOTE INCOMPATIBILITY *****\n\t  Fixes: CVE-2026-116273 max_parts and max_depth unlimited. bsc#1288714\n\t* Do not signal an ambiguous parse if we have filename=\"\" or\n\t  name=\"\"\n\t* Update author names in META.yml\n\t* Add git repo to META.yml\n  * 5.520\n\t* VERSION 5.520 RELEASED\n\t* MIME::Parser used O(N^2) CPU time and memory parsing a MIME\n\t  message nested N levels deep.  A smallish specially-crafted\n\t  message could DOS the computer by making it consume enormous\n\t  amounts of memory and CPU time.  The parser was modified to use\n\t  O(N) time and memory in this case.  Additionally, a new\n\t  MIME::Parser::max_depth() function was added to limit the nesting\n\t  depth before declaring a parse failure.  Problem was reported to\n\t  me by Zhaoyang Li and Xiang Li from AOSP Lab at Nankai University.\n\t* MIME::Parser would ignore multiple blank lines in a message\n\t  preamble when parsing it; this could break DKIM.  Problem pointed\n\t  out and fix suggested by Tim Henderson.\n\t* If a MIME boundary includes trailing whitespace, we mark the\n\t  parse as ambiguous.  Problem noted and patch submitted by\n\t  Christian Herdtweck\n  * 5.519\n\t* VERSION 5.519 RELEASED\n\t* Some (buggy) software creates base64-encoded parts as a\n\t  concatenation of multiple base64-encoded streams, and some client\n\t  software decodes each stream separately and concatenates the\n\t  results.  Duplicate this behavior in MIME::tools to prevent it\n\t  from being used as a mechanism to sneak dangerous content past a\n\t  security scanner.  Patch courtesy of Giorgio Premi\n\t  \u003cgiosh94mhz@gmail.com\u003e.\n\n- updated to 5.518.0 (5.518)\n  * 5.518\n\t* VERSION 5.518 RELEASED\n\t* Add tests for encoded \"boundary=XXX\" parameters and set\n\t  the ambiguous-parse flag if any are found.  Patch courtesy\n\t  of Dominik Csapak \u003cd.csapak@proxmox.com\u003e\n\t  MIME::tools chooses to decode encoded boundary parameters.\n\t  MUA behaviors differ; Claws-Mail decodes them while Thunderbird\n\t  does not.\n\t* Don't ignore invalid whitespace after \"boundary=XXX\" parameter.\n\t  Patch courtesy of Dominik Csapak \u003cd.csapak@proxmox.com\u003e\n\t* Ignore comments between tokens.  A header parameter can be\n\t  written foo(comment)=bar and it's the same as foo=bar.\n\t  Patch courtesy of Dominik Csapak \u003cd.csapak@proxmox.com\u003e\n\n- updated to 5.517.0 (5.517)\n  * 5.517\n\t* VERSION 5.517 RELEASED\n\t* Add a missing test message file that was causing tests to fail.\n  * 5.516\n\t* VERSION 5.516 RELEASED\n\t* Handle MIME parameters of the form param= better (ie,\n\t  a parameter with no value at all.)  It's treated the\n\t  same as param=\"\" rather than aborting the parse.\n\t* Diagnose additional types of malformed MIME as ambiguous.\n\t  Specifically, an empty boundary parameters like boundary= or\n\t  boundary=\"\" is treated as ambiguous.  Thanks to Stoiko Ivanov\n\t  \u003cs.ivanov@proxmox.com\u003e for pointing out this missing case.\n","status":"published","published":"2026-11-03T18:16:30Z","modified":"2026-11-04T14:15:29.468997774Z","updated_at":"2026-11-04T14:31:33.296313Z"}]}}