========================================================================
CVE-2026-116268                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-116268

   Distribution:  MIME-tools
       Versions:  before 5.521
       MetaCPAN:  https://metacpan.org/dist/MIME-tools
       VCS Repo:  https://salsa.debian.org/dskoll/mime-tools

MIME::Field::ParamVal versions before 5.521 for Perl allow CPU
exhaustion via unclosed comments in header parameters

Description
-----------
MIME::Field::ParamVal versions before 5.521 for Perl allow CPU
exhaustion via unclosed comments in header parameters.

The comment pattern used to parse Content-Type and Content-Disposition
parameters scans from each "(" to the next ")". In a field with no ")",
every "(" scans to the end of the header and fails, so parsing takes
time quadratic in the header length. The field is parsed again on each
attribute lookup, several times per MIME entity.

A 40 KB header takes about 7 seconds to parse once.

Problem types
-------------
- CWE-1333 Inefficient Regular Expression Complexity

Solutions
---------
Upgrade to MIME-tools 5.521 or later.

References
----------
https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes