Is CVE-2026-116269 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116269 being exploited in the wild.

How severe is CVE-2026-116269?

Informational severity, published 28 October 2026.

Is there a fix for CVE-2026-116269?

Yes: fixed in 5.521. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116269 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116269?

Check whether you run Perl MIME-tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116269: MIME-tools RFC 2231 language tag parsing empty filename

CVE-2026-116269 · Severity: info · Published 2026-10-28

MIME-tools is a Perl library for parsing and handling email messages. When processing email attachments with specially formatted filenames containing hyphenated language tags (such as en-US), the library incorrectly returns an empty filename instead of the actual attachment name. An attacker can exploit this to bypass email security policies that filter attachments by file extension, allowing malicious files to pass through email filters.

Technologies: Perl MIME-tools. Vendors: Perl.

Quick answers

Is CVE-2026-116269 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116269 being exploited in the wild.
How severe is CVE-2026-116269?: Informational severity, published 28 October 2026.
Which products and versions are affected?: Perl MIME-tools before 5.521.
Is there a fix for CVE-2026-116269?: Yes: fixed in 5.521. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116269 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116269?: Check whether you run Perl MIME-tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.521

Technical details

The vulnerability exists in MIME::Field::ParamVal's handling of RFC 2231-encoded filename parameters with hyphenated language tags. When a parameter like filename*=utf-8'en-US'payload.exe is parsed, the decoder fails to strip multi-word language suffixes (treats "EN-US" as inseparable from the charset), causing the charset lookup to fail and recommended_filename() to return an empty string instead of falling back to the name parameter. This allows malicious attachments to bypass filename-extension-based security policies.

Affected products

Perl MIME-tools before 5.521

Timeline

2026-10-28: disclosed
2026-10-27: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.