CVE-2026-116266

The record

MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous. The multipart_boundary() method decodes RFC 2047 encoded words anywhere in the boundary, but the ambiguity check only fires when the whole value is one encoded word. A boundary such as abc=?us-ascii?Q?def?= is used as abcdef, and ambiguous_content() returns false. Encoded words are not allowed in parameters, so other mail readers split the message on the literal value. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.

Affected packages

Related vulnerabilities

• CVE-2026-61789 DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. CWE-436
• CVE-2026-119200 Nuxt is an open-source web development framework for Vue.js. CWE-436
• CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-436
• CVE-2026-116272 MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary… CWE-436
• CVE-2026-116269 MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a… CWE-436
• CVE-2026-116264 MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type… CWE-436
• CVE-2026-116265 MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart… CWE-436
• CVE-2026-116695 Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. CWE-436