Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - MIME：：Field：:P aramVal 之前的 5.521 Perl 版本允許透過標頭參數中未關閉的註解而耗盡 CPU。用來剖析 Content-Type 和 Content-Disposition 參數的註解模式會從每個參數掃描到下一個 。在沒有 ） 的欄位中，every （ 掃描到標頭末尾並失敗，因此剖析需要標頭長度的二次時間。在每個屬性查詢時，都會再次剖析欄位，每個 MIME 實體會剖析數次。一個 40 KB 的標頭大約需要 7 秒才能剖析一次。（CVE-2026-116268）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Perl 之前 5.521 的 MIME：：Field：:P aramVal 版本允许通过标头参数中未关闭的注释耗尽 CPU。用于解析 Content-Type 和 Content-Disposition 参数的注释模式会从每个参数（到下一个）进行扫描。在没有 ）、every （ 扫描到标头末尾并失败的字段中，因此解析需要标头长度的二次时间。每次属性查找时都会再次解析该字段，每个 MIME 实体都会解析数次。解析一次 40 KB 标头大约需要 7 秒。（CVE-2026-116268）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - MIME::Field::P aramVal の 5.521 より前のバージョンPerl、ヘッダーパラメーターの閉じられていないコメントにより CPU が枯渇する可能性があります。Content-Type と Content-Disposition のパラメーターを解析するために使用されるコメントパターン。それぞれから ( 次へ) スキャンします。) のないフィールドでは、 every ( はヘッダーの最後までスキャンして失敗するため、解析にはヘッダーの長さの 2 乗の時間がかかります。フィールドは、各属性ルックアップ時に、MIME エンティティごとに数回解析されます。40KBのヘッダーを1回解析するのに約7秒かかります。(CVE-2026-116268)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

リモートホストにインストールされている FreeBSD のバージョンは、テスト済みバージョンより前です。したがって、2b2d5d3e-d2c8-11f1-97dc-40b034429ecf のアドバイザリに記載されている複数の脆弱性の影響を受けます。

    MIME-tools プロジェクトによる報告:
    多数のセキュリティ問題が対処されました(次の 10 の CVE を参照)CPANSec セキュリティグループにより、問題が私の注意を喚起され、パッチが提供されました。

Tenable は、前述の記述ブロックを FreeBSD セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-51fdfb7476 advisory.

    This is a cumulative bug-fix update, including multiple security fixes.

    Note that there is a change to some defaults: `max_parts` is now set to 1000 and `max_depth` to 64 rather     than being unlimited; this should not affect most real-world uses of `MIME::tools`, but you may need to     increase these values or set them to -1 (unlimited) if you run into trouble.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0e79d6ad13 advisory.

    This is a cumulative bug-fix update, including multiple security fixes.

    Note that there is a change to some defaults: `max_parts` is now set to 1000 and `max_depth` to 64 rather     than being unlimited; this should not affect most real-world uses of `MIME::tools`, but you may need to     increase these values or set them to -1 (unlimited) if you run into trouble.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a415b3bf48 advisory.

    This is a cumulative bug-fix update, including multiple security fixes.

    Note that there is a change to some defaults: `max_parts` is now set to 1000 and `max_depth` to 64 rather     than being unlimited; this should not affect most real-world uses of `MIME::tools`, but you may need to     increase these values or set them to -1 (unlimited) if you run into trouble.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header     parameters. The comment pattern used to parse Content-Type and Content-Disposition parameters scans from     each ( to the next ). In a field with no ), every ( scans to the end of the header and fails, so     parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup,     several times per MIME entity. A 40 KB header takes about 7 seconds to parse once. (CVE-2026-116268)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2b2d5d3e-d2c8-11f1-97dc-40b034429ecf advisory.

    MIME-tools project reports:
    Many security issues were addressed (see the following ten CVEs)               Issues were brought to my attention, and patches supplied, by the               CPANSec security group.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22226-1 advisory.

    Changes in perl-MIME-tools:

    - updated to 5.522.0 (5.522)
      * 5.522
            * VERSION 5.522 RELEASED
            * Many security issues were addressed (see the following ten CVEs)               Issues were brought to my attention, and patches supplied, by the               CPANSec security group.
            * parse_params: flag a parameter list that could not be parsed               Detect additional ambiguous parse situations when parameter               names contain illegal characters.  Fixes:
              CVE-2026-116264 invalid parameter hides boundary/filename. bsc#1288723
            * parse_params: check the boundary after RFC 2231 reassembly               Another ambiguous-parse case was missed (trailing space after               boundary was not detected for RFC-2231-encoded boundaries.)  Fixes:
              CVE-2026-116265 RFC 2231 boundary skips ambiguity checks. bsc#1288722
            * parse_params: Stricter checking for encoded boundaries; earlier               versions would miss some cases.  Fixes:
              CVE-2026-116266 boundary changed by decoding not flagged. bsc#1288721
            * Cap the indentation levels in the Results: structure.  Otherwise,               specially-crafted messages could consume large amounts of memory.
              Fixes: CVE-2026-116267 indent stored per message per level bsc#1288720
            * parse_params: stop a comment match at the next parenthesis.
              Otherwise, specially-crafted messages could cause the regex               back-tracker to consume large amounts of CPU time.  Note that               MIME::Parser does not correctly parse ((nested comments)) and               has never done so.  Fixes:
              CVE-2026-116268 unclosed ( comments backtrack CPU exhaustion. bsc#1288719
            * parse_params: re-encode filename* values without charset tricks               Specially-crafted messages could trick recommended_filename()               into returning an empty string instead of a plausible filename.
              Fixes: CVE-2026-116269 RFC 2231 language tag empties filename. bsc#1288718
            * decode_mimewords: do not copy the input into each error.  Otherwise,               specially-crafted messages could consume large amounts of memory.
              Fixes: CVE-2026-116270 each bad =? copies the input into $@. bsc#1288717
            * FileUnder: do not reuse an existing generated directory.  Otherwise,               attackers might be able to use symbolic links to get files created               in unexpected locations.  Fixes:
              CVE-2026-116271 FileUnder reuses a pre-created directory. bsc#1288716
            * parse_params: flag comments other readers do not skip               Specially-crafted messages could create ambiguous messages without               setting the ambiguous_parse flag.  Fixes:
              CVE-2026-116272  comment hides a duplicate boundary. bsc#1288715
            * Call whine() rather than error() if max_parts or max_depth is               exceeded during a parse.  This lets us return undef rather than               throwing an exception if ignore_errors() is set to 0.
            * Change to defaults: max_parts is now set to 1000 and max_depth               to 64 rather than being unlimited.  This should not affect most               real-world uses of MIME::tools, but you may need to increase               these values or set them to -1 (unlimited) if you run into trouble.
                  ***** NOTE INCOMPATIBILITY *****               Fixes: CVE-2026-116273 max_parts and max_depth unlimited. bsc#1288714
            * Do not signal an ambiguous parse if we have filename= or               name=
            * Update author names in META.yml
            * Add git repo to META.yml
      * 5.520
            * VERSION 5.520 RELEASED
            * MIME::Parser used O(N^2) CPU time and memory parsing a MIME               message nested N levels deep.  A smallish specially-crafted               message could DOS the computer by making it consume enormous               amounts of memory and CPU time.  The parser was modified to use               O(N) time and memory in this case.  Additionally, a new               MIME::Parser::max_depth() function was added to limit the nesting               depth before declaring a parse failure.  Problem was reported to               me by Zhaoyang Li and Xiang Li from AOSP Lab at Nankai University.
            * MIME::Parser would ignore multiple blank lines in a message               preamble when parsing it; this could break DKIM.  Problem pointed               out and fix suggested by Tim Henderson.
            * If a MIME boundary includes trailing whitespace, we mark the               parse as ambiguous.  Problem noted and patch submitted by               Christian Herdtweck
      * 5.519
            * VERSION 5.519 RELEASED
            * Some (buggy) software creates base64-encoded parts as a               concatenation of multiple base64-encoded streams, and some client               software decodes each stream separately and concatenates the               results.  Duplicate this behavior in MIME::tools to prevent it               from being used as a mechanism to sneak dangerous content past a               security scanner.  Patch courtesy of Giorgio Premi               <giosh94mhz@gmail.com>.

    - updated to 5.518.0 (5.518)
      * 5.518
            * VERSION 5.518 RELEASED
            * Add tests for encoded boundary=XXX parameters and set               the ambiguous-parse flag if any are found.  Patch courtesy               of Dominik Csapak <d.csapak@proxmox.com>               MIME::tools chooses to decode encoded boundary parameters.
              MUA behaviors differ; Claws-Mail decodes them while Thunderbird               does not.
            * Don't ignore invalid whitespace after boundary=XXX parameter.
              Patch courtesy of Dominik Csapak <d.csapak@proxmox.com>
            * Ignore comments between tokens.  A header parameter can be               written foo(comment)=bar and it's the same as foo=bar.
              Patch courtesy of Dominik Csapak <d.csapak@proxmox.com>

    - updated to 5.517.0 (5.517)
      * 5.517
            * VERSION 5.517 RELEASED
            * Add a missing test message file that was causing tests to fail.
      * 5.516
            * VERSION 5.516 RELEASED
            * Handle MIME parameters of the form param= better (ie,               a parameter with no value at all.)  It's treated the               same as param= rather than aborting the parse.
            * Diagnose additional types of malformed MIME as ambiguous.
              Specifically, an empty boundary parameters like boundary= or               boundary= is treated as ambiguous.  Thanks to Stoiko Ivanov               <s.ivanov@proxmox.com> for pointing out this missing case.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
372776	Linux Distros 未修補弱點：CVE-2026-116268	Nessus	Misc.	10/28/2026	11/6/2026	high
372776	Linux Distros 未修补的漏洞：CVE-2026-116268	Nessus	Misc.	10/28/2026	11/6/2026	high
372776	Linux Distros のパッチ未適用の脆弱性: CVE-2026-116268	Nessus	Misc.	10/28/2026	11/6/2026	high
373481	FreeBSD:p5-MIME-Tools -- 複数の脆弱性(2b2d5d3e-d2c8-11f1-97dc-40b034429ecf)	Nessus	FreeBSD Local Security Checks	10/29/2026	11/6/2026	high
376845	Fedora 45 : perl-MIME-tools (2026-51fdfb7476)	Nessus	Fedora Local Security Checks	11/6/2026	11/6/2026	high
376833	Fedora 44 : perl-MIME-tools (2026-0e79d6ad13)	Nessus	Fedora Local Security Checks	11/6/2026	11/6/2026	high
376854	Fedora 43 : perl-MIME-tools (2026-a415b3bf48)	Nessus	Fedora Local Security Checks	11/6/2026	11/6/2026	high
372776	Linux Distros Unpatched Vulnerability : CVE-2026-116268	Nessus	Misc.	10/28/2026	11/6/2026	high
373481	FreeBSD : p5-MIME-Tools -- multiple vulnerabilities (2b2d5d3e-d2c8-11f1-97dc-40b034429ecf)	Nessus	FreeBSD Local Security Checks	10/29/2026	11/6/2026	high
376246	openSUSE 16 Security Update : perl-MIME-tools (openSUSE-SU-2026:22226-1)	Nessus	SuSE Local Security Checks	11/5/2026	11/5/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high