Vulnerability · Published Oct 28, 2026 · Assigned by CPANSec
CVE-2026-116268MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters
High 7.5
In plain English
A high-severity regular-expression denial of service in MIME-tools. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity. A 40 KB header takes about 7 seconds to parse once.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libmime-tools-perl | no fix listed | DEBIAN-CVE-2026-116268 |
| Debian:13 | libmime-tools-perl | no fix listed | DEBIAN-CVE-2026-116268 |
| Debian:14 | libmime-tools-perl | 5.522-1 | DEBIAN-CVE-2026-116268 |
| Ubuntu:22.04:LTS | libmime-tools-perl | no fix listed | UBUNTU-CVE-2026-116268 |
| Ubuntu:24.04:LTS | libmime-tools-perl | no fix listed | UBUNTU-CVE-2026-116268 |
| Ubuntu:26.04:LTS | libmime-tools-perl | no fix listed | UBUNTU-CVE-2026-116268 |
| Ubuntu:26.10 | libmime-tools-perl | no fix listed | UBUNTU-CVE-2026-116268 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MIME-tools | 0 – before 5.521 |
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H