CVE-2026-116272

The MIME::Field::ParamVal component in Perl (versions before 5.521 ) fails to flag duplicate boundary parameters when the name contains a nested comment, such as boundary((c))="A". This causes the parameter to be stored under its literal name, allowing a second boundary parameter to go undetected...

CVE-2026-116272 MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written boundaryc="A" or boundary="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a...