228 matches found
cve-2021-44790-lab
CVE-2021-44790 Lab This repository contains a small local lab and proof-of-concept tooling for reproducing the Apache HTTP Server vulnerability tracked as CVE-2021-44790. Overview CVE-2021-44790 is a vulnerability in Apache HTTP Server 2.4.51/2.4.52 involving the modlua multipart request parser. ...
CVE-2026-116265
A flaw was found in perl-MIME-tools. A remote attacker can exploit this vulnerability to bypass email security filters by sending an email with specially crafted multipart boundary parameters. Because the parser does not properly validate boundary parameters split across continuations, it process...
CVE-2026-116265
MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections boundary0=, boundary1= and so on is joined after...
EUVD-2026-112298
MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous. The multipartboundary method decodes RFC 2047 encoded words anywhere in the boundary, but the ambiguity check only fires when the whole value is one encoded wor...
CVE-2026-116265
MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections boundary0=, boundary1= and so on is joined after...
CVE-2026-116265
The MIME::Field::ParamVal component in Perl (versions before 5.521 ) fails to flag ambiguous multipart boundaries written as RFC 2231 continuations. The root cause is that boundary ambiguity checks only examine plain boundary= parameters, while RFC 2231 sections (e.g., boundary*0=, boundary*1=) a...
CVE-2026-116265 MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations
MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections boundary0=, boundary1= and so on is joined after...
EUVD-2026-112297
MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections boundary0=, boundary1= and so on is joined after...
CVE-2026-116264 MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary
MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops...
EUVD-2026-112293
MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops...
PT-2026-129078
Name of the Vulnerable Software and Affected Versions MIME::Field::ParamVal versions prior to 5.521 Description Parameter parsing stops at the first parameter with an unreadable name, such as those containing an 8-bit byte or formatted as x:y=1, causing all subsequent parameters to be dropped. If...
PT-2026-129079
Name of the Vulnerable Software and Affected Versions MIME::Field::ParamVal versions prior to 5.521 Description The software fails to flag ambiguous multipart boundaries when they are written as RFC 2231 continuations. Boundary ambiguity checks only examine the plain boundary= parameter, while...
CVE-2026-116265: Interpretation Conflict
MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections boundary0=, boundary1= and so on is joined after...
CVE-2026-116266: Interpretation Conflict
MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous. The multipartboundary method decodes RFC 2047 encoded words anywhere in the boundary, but the ambiguity check only fires when the whole value is one encoded wor...
CVE-2026-116264: Interpretation Conflict
MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops...
PT-2026-129080
Name of the Vulnerable Software and Affected Versions MIME::Head versions 5.518 through 5.520 Description The multipart boundary method decodes RFC 2047 encoded words within a boundary but fails to flag the parse as ambiguous unless the entire value consists of a single encoded word. This allows ...
CVE-2026-110658
A flaw was found in Sofia-SIP. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a specially crafted Session Initiation Protocol SIP message containing an oversized multipart boundary that exceeds the message body length. During message parsing, this flaw causes the...
GHSA-XJH9-V7X6-24JW @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...
