{"id":"CVE-2026-116264","published":"2026-10-28T18:17:12.797","lastModified":"2026-10-28T18:17:12.797","description":"MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary.\n\nParameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded part without marking the parse as ambiguous.\n\nMail readers that skip the invalid parameter still find the boundary. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-436"],"vendors":[],"products":[],"references":[{"url":"https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}