CVE-2026-116268

Full vulnerability record from the local CVENow database.

Description

MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity. A 40 KB header takes about 7 seconds to parse once.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Awaiting Analysis

Source identifier

9b29abf9-4ab0-4765-b253-1875cd9b441e

Published

2026-10-28 18:17:13.250000

Last modified

2026-10-29 15:11:53

View original CVE JSON

{
  "id": "CVE-2026-116268",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-10-28T18:17:13.250",
  "lastModified": "2026-10-29T15:11:53.000",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.\n\nThe comment pattern used to parse Content-Type and Content-Disposition parameters scans from each \"(\" to the next \")\". In a field with no \")\", every \"(\" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.\n\nA 40 KB header takes about 7 seconds to parse once."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "MIME-tools",
          "modules": [
            "MIME::Field::ParamVal"
          ],
          "programFiles": [
            "lib/MIME/Field/ParamVal.pm"
          ],
          "programRoutines": [
            {
              "name": "MIME::Field::ParamVal::parse_params"
            }
          ],
          "repo": "https://salsa.debian.org/dskoll/mime-tools",
          "packageURL": "pkg:cpan/MIME-tools",
          "versions": [
            {
              "version": "0",
              "lessThan": "5.521",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ]
}