MIME-tools 5.522

on Perl CPAN

• VERSION 5.522 RELEASED

• Many security issues were addressed (see the following ten CVEs)
  Issues were brought to my attention, and patches supplied, by the
  CPANSec security group.

• parse_params: flag a parameter list that could not be parsed
  Detect additional ambiguous parse situations when parameter
  names contain illegal characters. Fixes:
  CVE-2026-116264 invalid parameter hides boundary/filename

• parse_params: check the boundary after RFC 2231 reassembly
  Another ambiguous-parse case was missed (trailing space after
  boundary was not detected for RFC-2231-encoded boundaries.) Fixes:
  CVE-2026-116265 RFC 2231 boundary skips ambiguity checks

• parse_params: Stricter checking for encoded boundaries; earlier
  versions would miss some cases. Fixes:
  CVE-2026-116266 boundary changed by decoding not flagged

• Cap the indentation levels in the Results: structure. Otherwise,
  specially-crafted messages could consume large amounts of memory.
  Fixes: CVE-2026-116267 indent stored per message per level

• parse_params: stop a comment match at the next parenthesis.
  Otherwise, specially-crafted messages could cause the regex
  back-tracker to consume large amounts of CPU time. Note that
  MIME::Parser does not correctly parse ((nested comments)) and
  has never done so. Fixes:
  CVE-2026-116268 unclosed "(" comments backtrack CPU exhaustion

• parse_params: re-encode filename* values without charset tricks
  Specially-crafted messages could trick recommended_filename()
  into returning an empty string instead of a plausible filename.
  Fixes: CVE-2026-116269 RFC 2231 language tag empties filename

• decode_mimewords: do not copy the input into each error. Otherwise,
  specially-crafted messages could consume large amounts of memory.
  Fixes: CVE-2026-116270 each bad "=?" copies the input into $@

• FileUnder: do not reuse an existing generated directory. Otherwise,
  attackers might be able to use symbolic links to get files created
  in unexpected locations. Fixes:
  CVE-2026-116271 FileUnder reuses a pre-created directory

• parse_params: flag comments other readers do not skip
  Specially-crafted messages could create ambiguous messages without
  setting the ambiguous_parse flag. Fixes:
  CVE-2026-116272 comment hides a duplicate boundary

• Call whine() rather than error() if max_parts or max_depth is
  exceeded during a parse. This lets us return undef rather than
  throwing an exception if ignore_errors() is set to 0.

• Change to defaults: max_parts is now set to 1000 and max_depth
  to 64 rather than being unlimited. This should not affect most
  real-world uses of MIME::tools, but you may need to increase
  these values or set them to -1 (unlimited) if you run into trouble.

  ***** NOTE INCOMPATIBILITY *****

Fixes: CVE-2026-116273 max_parts and max_depth unlimited

• Do not signal an ambiguous parse if we have filename="" or
  name=""

• Update author names in META.yml

• Add git repo to META.yml