CVE-2026-116272 Affecting libmime-tools-perl package, versions *

Note: Versions mentioned in the description apply only to the upstream libmime-tools-perl package and not the libmime-tools-perl package as distributed by Debian. See How to fix? for Debian:14 relevant fixed versions and status.

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.

A parameter written boundary((c))="A" or boundary())="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it.

Readers that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.

• https://security-tracker.debian.org/tracker/CVE-2026-116272
• https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes