Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-94440

Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Description

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library net/textproto

Default version status: unaffected

  • 0 to < 1.26.9affected
  • 1.27.0-0 to < 1.27.2affected

Go standard library mime/multipart

Default version status: unaffected

  • 0 to < 1.26.9affected
  • 1.27.0-0 to < 1.27.2affected

References