Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD7.5 High

CVE-2026-42504

Quadratic complexity in WordDecoder.DecodeHeader in mime

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library mime

Default version status: unaffected

  • 0 to < 1.25.11affected
  • 1.26.0-0 to < 1.26.4affected

References