–
Not scored
CVE-2026-116268
MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters
MIME-tools · Regular expression denial of service · CWE-1333AffectedMIME-tools
FixUpdate to 5.521 or newer
PublishedOct 28, 17:33 · CPANSec
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity. A 40 KB header takes about 7 seconds to parse once.
From CPANSec
Affected and fixed versions
ProductAffectedFixed inMIME-toolsbefore 5.5215.521
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known