MIME::Field::ParamVal versions before 5.521 for Perl do not properly flag duplicate boundary parameters when the parameter name contains a nested comment. This causes the parser to store such parameters under their literal names instead of the expected 'boundary' name, allowing a second boundary parameter to go undetected as a duplicate. As a result, MIME::Parser splits the message on the second boundary, while readers that skip comments per RFC 5322 take the first boundary. This discrepancy allows a remote sender to hide an attachment from filters relying on ambiguous_content(), although the recipient's mail client will display the attachment.