MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.
The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.
A 40 KB header takes about 7 seconds to parse once.
The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.
A 40 KB header takes about 7 seconds to parse once.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
Upgrade to MIME-tools 5.521 or later.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes |
|
History
Wed, 28 Oct 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity. A 40 KB header takes about 7 seconds to parse once. | |
| Title | MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters | |
| Weaknesses | CWE-1333 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-28T17:33:04.336Z
Reserved: 2026-10-25T18:05:02.236Z
Link: CVE-2026-116268
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-28T18:17:13.250
Modified: 2026-10-28T18:17:13.250
Link: CVE-2026-116268
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses