Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CVE-2026-116272: Perl libmime-tools-perl can hide email attachments
CVE-2026-116272 · published 7 days ago
Summary
The libmime-tools-perl library used on Debian can be tricked by specially crafted email boundaries, causing the email parser to miss a duplicate part. This lets a sender conceal an attachment from security filters while it still appears to the recipient. Update the libmime-tools-perl package to the latest version or apply the vendor’s patch to resolve the issue.
What to do
- Update debian libmime-tools-perl to version 5.522-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:14 | debian | libmime-tools-perl |
< 5.522-1 Fix: upgrade to 5.522-1
|
| Debian:12 | debian | libmime-tools-perl | All versions |
| Debian:13 | debian | libmime-tools-perl | All versions |
| Ubuntu:14.04:LTS | canonical | libmime-tools-perl | All versions |
Original advisory text
DEBIAN-CVE-2026-116272
MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written boundary((c))="A" or boundary(\))="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it. Readers that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.
References
- https://security-tracker.debian.org/tracker/CVE-2026-116272 Vendor Advisory
- https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
- https://ubuntu.com/security/CVE-2026-116272 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-116272 Third Party Advisory
- https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes Third Party Advisory
Type
CWE-436Interpretation Conflict
Timeline
Published28 Oct 2026
Updated3 Nov 2026
First seen27 Oct 2026
Sources
DEBIAN-CVE-2026-116272 · OSV
CVE-2026-116272 · NVD
CVE-2026-116272 · MITRE
UBUNTU-CVE-2026-116272 · OSV
Track software like this
Free during beta