# CVE-2026-116269: MIME-tools RFC 2231 language tag parsing empty filename

Source: https://junglewise.ai/threats/cve-2026-116269-mime-field-paramval-versions-before-5-521-for-perl-turn-an-rfc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-116269 · Severity: info · Published 2026-10-28

MIME-tools is a Perl library for parsing and handling email messages. When processing email attachments with specially formatted filenames containing hyphenated language tags (such as en-US), the library incorrectly returns an empty filename instead of the actual attachment name. An attacker can exploit this to bypass email security policies that filter attachments by file extension, allowing malicious files to pass through email filters.

Technologies: [Perl MIME-tools](https://junglewise.ai/threats/technologies/mime-tools). Vendors: [Perl](https://junglewise.ai/threats/vendors/perl).

## Quick answers

**Is CVE-2026-116269 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116269 being exploited in the wild.

**How severe is CVE-2026-116269?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** Perl MIME-tools before 5.521.

**Is there a fix for CVE-2026-116269?** Yes: fixed in 5.521. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116269 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116269?** Check whether you run Perl MIME-tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.521

## Technical details

The vulnerability exists in MIME::Field::ParamVal's handling of RFC 2231-encoded filename parameters with hyphenated language tags. When a parameter like filename*=utf-8'en-US'payload.exe is parsed, the decoder fails to strip multi-word language suffixes (treats "EN-US" as inseparable from the charset), causing the charset lookup to fail and recommended_filename() to return an empty string instead of falling back to the name parameter. This allows malicious attachments to bypass filename-extension-based security policies.

## Affected products

- Perl MIME-tools before 5.521

## Timeline

- 2026-10-28: disclosed
- 2026-10-27: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes](https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes)

## Related threats

- [MIME-tools MIME::Parser duplicate boundary detection bypass with comments](https://junglewise.ai/threats/cve-2026-116272-mime-field-paramval-versions-before-5-521-for-perl-do-not-flag-a)
- [MIME-tools FileUnder symlink following directory reuse](https://junglewise.ai/threats/cve-2026-116271-mime-parser-fileunder-versions-before-5-521-for-perl-reuse-a-pre)
- [MIME-tools ParamVal regex backtracking CPU exhaustion](https://junglewise.ai/threats/cve-2026-116268-mime-field-paramval-versions-before-5-521-for-perl-allow-cpu)
- [MIME::tools RFC 2231 boundary ambiguity check bypass](https://junglewise.ai/threats/cve-2026-116265-mime-field-paramval-versions-before-5-521-for-perl-do-not-flag)