CVE-2026-116265
Description
A flaw was found in perl-MIME-tools. A remote attacker can exploit this vulnerability to bypass email security filters by sending an email with specially crafted multipart boundary parameters. Because the parser does not properly validate boundary parameters split across continuations, it processes message parts differently from standard email clients, allowing hidden attachments to evade inspection while still displaying to the recipient.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Access Control,Integrity
Technical Impact: Bypass Protection Mechanism; Execute Unauthorized Code or Commands
An attacker could bypass the protection mechanism by including dangerous inputs that are only produced after the modification (such as canonicalization and cleansing). This can be used to launch various attacks including injection, executing arbitrary code, or causing other unintended behavior.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
