CPANSA-MIME-tools-2026-116268: MIME-tools vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-10-28T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-10-28T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | Severity | ||
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.
The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.
A 40 KB header takes about 7 seconds to parse once.
Vulnerabilities
CVE-2026-116268
Vulnerability DescriptionMIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.
The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.
A 40 KB header takes about 7 seconds to parse once.
| Weakness | CWE-1333 : Inefficient Regular Expression Complexity |
|---|
Product status
Known affected
| Product | Score | ||||
|---|---|---|---|---|---|
| MIME-tools less than 5.521 |
|
Fixed
- MIME-tools greater than or equal 5.521
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-MIME-tools-2026-116268 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-mime-tools-2026-116268.json - https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes external
https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes - CVE-2026-116268 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-116268
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Wed Oct 28 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/