CVE-2026-42507

Name
CVE-2026-42507
Description
When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security@golang.org https://go.dev/cl/777060
security@golang.org https://go.dev/issue/79346
security@golang.org https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
security@golang.org https://pkg.go.dev/vuln/GO-2026-5039

Match rules

CPE URI Source package Min version Max version

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
go edge-community 1.26.4-r0 Achill Gilgenast <achill@achill.org> fixed
go 3.24-community 1.26.8-r0 Achill Gilgenast <achill@achill.org> fixed