Changes for version 5.522 - 2026-10-27
- VERSION 5.522 RELEASED
- Many security issues were addressed (see the following ten CVEs) Issues were brought to my attention, and patches supplied, by the CPANSec security group.
- parse_params: flag a parameter list that could not be parsed Detect additional ambiguous parse situations when parameter names contain illegal characters. Fixes: CVE-2026-116264 invalid parameter hides boundary/filename
- parse_params: check the boundary after RFC 2231 reassembly Another ambiguous-parse case was missed (trailing space after boundary was not detected for RFC-2231-encoded boundaries.) Fixes: CVE-2026-116265 RFC 2231 boundary skips ambiguity checks
- parse_params: Stricter checking for encoded boundaries; earlier versions would miss some cases. Fixes: CVE-2026-116266 boundary changed by decoding not flagged
- Cap the indentation levels in the Results: structure. Otherwise, specially-crafted messages could consume large amounts of memory. Fixes: CVE-2026-116267 indent stored per message per level
- parse_params: stop a comment match at the next parenthesis. Otherwise, specially-crafted messages could cause the regex back-tracker to consume large amounts of CPU time. Note that MIME::Parser does not correctly parse ((nested comments)) and has never done so. Fixes: CVE-2026-116268 unclosed "(" comments backtrack CPU exhaustion
- parse_params: re-encode filename* values without charset tricks Specially-crafted messages could trick recommended_filename() into returning an empty string instead of a plausible filename. Fixes: CVE-2026-116269 RFC 2231 language tag empties filename
- decode_mimewords: do not copy the input into each error. Otherwise, specially-crafted messages could consume large amounts of memory. Fixes: CVE-2026-116270 each bad "=?" copies the input into $@
- FileUnder: do not reuse an existing generated directory. Otherwise, attackers might be able to use symbolic links to get files created in unexpected locations. Fixes: CVE-2026-116271 FileUnder reuses a pre-created directory
- parse_params: flag comments other readers do not skip Specially-crafted messages could create ambiguous messages without setting the ambiguous_parse flag. Fixes: CVE-2026-116272 comment hides a duplicate boundary
- Call whine() rather than error() if max_parts or max_depth is exceeded during a parse. This lets us return undef rather than throwing an exception if ignore_errors() is set to 0.
- Change to defaults: max_parts is now set to 1000 and max_depth to 64 rather than being unlimited. This should not affect most real-world uses of MIME::tools, but you may need to increase these values or set them to -1 (unlimited) if you run into trouble.
- NOTE INCOMPATIBILITY *****
- Fixes: CVE-2026-116273 max_parts and max_depth unlimited
- Do not signal an ambiguous parse if we have filename="" or name=""
- Update author names in META.yml
- Add git repo to META.yml
Modules
the body of a MIME message
an object for decoding the body part of a MIME stream
encode/decode a "base64" stream
decode a "binhex" stream
perform no encoding/decoding
decode a "base64" gzip stream
encode/decode a "7bit" or "8bit" stream
encode/decode a "quoted-printable" stream
decode a "uuencoded" stream
class for parsed-and-decoded MIME message
a "Content-transfer-encoding" field
a "Content-disposition" field
a "Content-type" field
subclass of Mail::Field, for structured MIME fields
MIME message header (a subclass of Mail::Header)
experimental class for parsing MIME streams
manage file-output of the parser
a line-oriented reader for a MIME::Parser
results of the last entity parsed
modules for parsing (and creating!) MIME entities
decode RFC 2047 encoded words to a local representation
deal with RFC 2047 encoded words
Provides
in lib/MIME/Body.pm
in lib/MIME/Body.pm
in lib/MIME/Body.pm
in lib/MIME/Parser/Filer.pm
in lib/MIME/Parser/Filer.pm
in lib/MIME/WordDecoder.pm
in lib/MIME/WordDecoder.pm
in lib/MIME/WordDecoder.pm