CVE-2026-42504

Timeline

Detection, updates, and resolution for this record.

1. Jun 2, 2026 · Catalog

   Detected

   Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

2. Oct 10, 2026 · Catalog

   Fix available

   Go stdlib 0 → 1.25.11

3. Oct 10, 2026 · Catalog

   Updated

   Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

4. Oct 15, 2026 · CIRCL Vulnerability Lookup

   Updated

   Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Affected

• Go stdlib0 → 1.25.11
• vendor Go standard library mimeversion unspecified

Sources

• CIRCL Vulnerability LookupCVE-2026-42504

  Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

  vulnerability.circl.lu
• CVE.orgCVE-2026-42504

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2026-42504

  30-day exploitation probability 0.6%

  first.org
• OSV.devGO-2026-5038

  Quadratic complexity in WordDecoder.DecodeHeader in mime

  osv.dev

References

• FIX · go.dev
• REPORT · go.dev
• WEB · groups.google.com
• Reference · pkg.go.dev