---
id: CVE-2026-116272
title: >-
  MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate
  boundary parameter whose name contains a nested comment
summary: >-
  MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate
  boundary parameter whose name contains a nested comment.


  A parameter written boundary((c))="A" or boundary(\))="A" is stored under that
  literal name rather tha…
severity: none
cwe:
  - CWE-436
product: MIME-tools
affected:
  - MIME-tools < 5.521
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:34:25.862Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116272'
references:
  - url: 'https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes'
tags:
  - cve.org
ingestedAt: '2026-10-28T18:15:46.380Z'
epss: 0.00177
epssPercentile: 0.07298
---

## Overview

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.

A parameter written boundary((c))="A" or boundary(\))="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it.

Readers that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.

## Affected

- `MIME-tools < 5.521`

## Remediation

Upgrade to MIME-tools 5.521 or later.