CVE-2026-42504

Name
CVE-2026-42504
Description
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security@golang.org https://go.dev/cl/774481
security@golang.org https://go.dev/issue/79217
security@golang.org https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
security@golang.org https://pkg.go.dev/vuln/GO-2026-5038

Match rules

CPE URI Source package Min version Max version

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
go edge-community 1.26.4-r0 Achill Gilgenast <achill@achill.org> fixed
go 3.24-community 1.26.8-r0 Achill Gilgenast <achill@achill.org> fixed