MIME::Parser versions before 5.521 for Perl have a vulnerability where no limit is set on the number of message parts by default, which can lead to memory exhaustion. The max_parts option defaulted to -1, disabling limits and allowing the parser to build an entity for every part in a message regardless of quantity. Version 5.521 introduces default limits of max_parts to 1000 and max_depth to 64 to mitigate this issue.
CVE-2026-116272 is a vulnerability in MIME::Field::ParamVal for Perl versions before 5.521 where duplicate boundary parameters containing nested comments are not correctly flagged. This causes MIME::Parser to split messages incorrectly, allowing a remote sender to hide attachments from filters relying on ambiguous_content() while the recipient's mail client still displays the attachment.
MIME::Parser::FileUnder in MIME-tools versions before 5.521 allows local users to redirect attachment writes by exploiting symlink following in pre-created output directories. This occurs when the output base directory is writable by other users, enabling an attacker to create symlinks that cause the parser to write attachments to unintended locations.
MIME::Words versions before 5.521 for Perl contain an inefficient algorithmic complexity vulnerability in the decode_mimewords function. This flaw allows memory exhaustion via repeated "=?" sequences. Each incomplete encoded word starting with "=?" causes an error message containing the entire input string to be appended repeatedly, leading to large memory consumption. From version 5.518, MIME::Parser decodes every multipart boundary similarly, enabling a remote sender to exhaust memory with a crafted Content-Type header.
CVE-2026-116269 is a vulnerability in MIME::Field::ParamVal versions before 5.521 for Perl where an RFC 2231 filename with a hyphenated language tag is incorrectly parsed, resulting in an empty recommended filename. This occurs because the decoder fails to strip the language suffix when it contains a hyphen, causing the recommended_filename() method to return an empty string instead of the actual filename. This behavior differs from other mail readers that correctly return the filename. A remote attacker can exploit this to bypass file extension checks on attachments by causing the recommended filename to be empty.
CVE-2026-116268 is a vulnerability in MIME::Field::ParamVal versions before 5.521 for Perl, where inefficient regular expression handling of unclosed comments in MIME header parameters can cause CPU exhaustion. Parsing a header with unclosed parentheses results in quadratic time complexity, significantly slowing processing. This issue is fixed in version 5.521.
MIME::Parser versions before 5.521 for Perl contain an inefficient algorithmic complexity vulnerability that can lead to memory exhaustion. This occurs when deeply nested MIME messages are truncated, causing error messages to be indented and logged at each nesting level, resulting in quadratic growth of stored diagnostics. The default configuration does not limit nesting depth, making the parser susceptible to this issue.
MIME::Head versions from 5.518 up to but not including 5.521 for Perl improperly decode multipart boundaries containing partially encoded words without marking them as ambiguous. This allows a remote sender to craft a multipart boundary that is interpreted differently by MIME-tools and other mail readers, potentially hiding attachments from filters relying on ambiguous_content() checks while still displaying them in recipients' mail clients.
MIME::Field::ParamVal versions before 5.521 for Perl have a vulnerability where ambiguous multipart boundaries written as RFC 2231 continuations are not properly flagged. This allows a remote sender to craft a MIME message that splits on different boundaries between the MIME::Parser and other mail readers, potentially hiding attachments from filters relying on ambiguous_content() while still displaying them in the recipient's mail client.
CVE-2026-116264 affects MIME::Field::ParamVal in MIME-tools for Perl versions before 5.521. An invalid Content-Type parameter can cause the parser to stop reading subsequent parameters, including the multipart boundary. This results in the multipart body being treated as a single undecoded part without ambiguity marking. Consequently, a remote sender can hide attachments from filters relying on ambiguous_content(), while the recipient's mail client still displays the attachment.