MIME::Field::ParamVal versions before 5.521 for Perl contain a vulnerability that allows CPU exhaustion via unclosed comments in header parameters. The parsing logic scans from each opening parenthesis to the next closing parenthesis, but if a closing parenthesis is missing, the scan extends to the end of the header, causing quadratic time complexity in parsing. This can lead to significant CPU resource consumption, with a 40 KB header taking about 7 seconds to parse once.