Home

Description

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

PUBLISHED Reserved 2026-04-28 | Published 2026-06-02 | Updated 2026-06-03 | Assigner Go

Problem types

CWE-407: Inefficient Algorithmic Complexity

Product status

Default status
unaffected

Any version before 1.25.11
affected

1.26.0-0 (semver) before 1.26.4
affected

Credits

p4p3r (https://hackerone.com/p4p3r_hak)

References

go.dev/issue/79217

go.dev/cl/774481

groups.google.com/g/golang-announce/c/tKs3rmcBcKw

pkg.go.dev/vuln/GO-2026-5038

cve.org (CVE-2026-42504)

nvd.nist.gov (CVE-2026-42504)

Download JSON