Quick answers
- Is CVE-2026-116268 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116268 being exploited in the wild.
- How severe is CVE-2026-116268?
- Informational severity, published 28 October 2026.
- Which products and versions are affected?
- Perl MIME-tools before 5.521.
- Is there a fix for CVE-2026-116268?
- Yes: fixed in MIME-tools 5.521. Until then: Upgrade to MIME-tools version 5.521 or later. If unable to upgrade immediately, restrict email processing of untrusted MIME messages or implement timeouts on parsing operations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116268 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-116268?
- Check whether you run Perl MIME-tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: MIME-tools 5.521
Upgrade to MIME-tools version 5.521 or later. If unable to upgrade immediately, restrict email processing of untrusted MIME messages or implement timeouts on parsing operations.
Technical details
The vulnerability exists in the comment pattern used to parse Content-Type and Content-Disposition header parameters. When an unclosed "(" comment marker appears in a header, the regex engine scans to the end of the header before failing, causing quadratic time complexity relative to header length. Since parameters are parsed multiple times per MIME entity, a 40 KB malformed header can take approximately 7 seconds to parse.
Affected products
- Perl MIME-tools before 5.521
Timeline
- 2026-10-28: disclosed
- 2026-10-27: patched