CVE-2026-116268

The record

MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity. A 40 KB header takes about 7 seconds to parse once.

Affected packages

Related vulnerabilities

• CVE-2026-62864 Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. CWE-1333
• CVE-2026-119300 Wekan is open source kanban built with Meteor. CWE-1333
• CVE-2026-118993 CallBackery versions before 0.62.0 for Perl allow denial of service via the request path… CWE-1333
• CVE-2026-115866 Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular… CWE-1333
• CVE-2026-119202 @hapi/content provides HTTP Content-* header parsing. CWE-1333
• CVE-2026-118779 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-1333
• CVE-2026-118772 joi is a schema description language and data validator for JavaScript. CWE-1333
• CVE-2026-118686 EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability… CWE-1333