CPU exhaustion in MIME::Field::ParamVal for Perl via unclosed comments
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-1333.
Summary
MIME-tools versions from 0 before 5.521 (MIME::Field::ParamVal for Perl) use a comment pattern that scans from each opening parenthesis to the next closing one when parsing Content-Type and Content-Disposition parameters. A header with an unclosed comment makes parsing time quadratic in the header length (CWE-1333). A remote unauthenticated attacker can exhaust CPU by sending such a header, because the field is parsed again on each attribute lookup.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity. A 40 KB header takes about 7 seconds to parse once.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | MIME-tools | before 5.521 | 5.521 | Patch available | CNA |
- MIME-tools Vendor— Affected before 5.521 Fixed in 5.521 Patch available CNA
Remediation
Update MIME-tools to version 5.521, which fixes the flaw. Red Hat Enterprise Linux 6 is affected and has no fix planned according to Red Hat's rating of Moderate.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA MIME-tools Fixed in 5.521
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-28 Threatist record created from CVE-2026-116268
- 2026-10-28 Alias added: GHSA-cgxv-575f-wxjm
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 CVSS score added · Red Hat
- 2026-11-05 CVSS score added · CISA ADP
- 2026-11-05 CISA SSVC decision points changed
References
Sources
- CVE-2026-116268 · CVE Program
- CVE-2026-116268 · NVD
- FIRST EPSS
- GHSA-cgxv-575f-wxjm · GitHub Advisory Database · CC BY 4.0
- CVE-2026-116268 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences