Bug 2563048 (CVE-2026-116272)

Summary:	CVE-2026-116272 perl-mime-tools: perl-mime-tools: Security filter bypass via nested comments in boundary parameters
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in perl-mime-tools. A remote attacker can bypass email security filters by sending a specially crafted message containing duplicate Multipurpose Internet Mail Extensions (MIME) boundary parameters with nested comments. Because the parser fails to properly normalize parameter names containing comments, it treats duplicate boundaries as separate entries rather than flagging them as duplicates. This parsing discrepancy allows an attacker to conceal malicious email attachments from security inspection tools while the recipient's email client displays them.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2563417
Bug Blocks:

Description OSIDB Bzimport 2026-10-28 17:42:15 UTC

MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.

A parameter written boundary((c))="A" or boundary(\))="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it.

Readers that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.