Quadratic complexity in WordDecoder.DecodeHeader in mime

HIGH 7.5CVE-2026-42504 · BIT-golang-2026-42504 · GO-2026-5038 · Published 02/06/2026 · updated 22/07/2026

In short

CVE-2026-42504 is a HIGH (CVSS 7.5) vulnerability affecting stdlib.
Chance of exploitation in the next 30 days (EPSS): 0.56%, higher than 46.6% of all vulnerabilities.
Fix: update to 1.26.4, 1.25.11 or later.

Package	Affected versions	Patched versions
stdlib Go	`≥ 1.26.0-0, < 1.26.4< 1.25.11`	`1.26.41.25.11`

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

NVD description

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≥ 1.26.0-0, < 1.26.4< 1.25.11

1.26.41.25.11

More vulnerabilities in stdlib

See all →