CVE-2026-42504

7.5 highEPSS 0.6%

High (7.5). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in stdlib 1.25.11, 1.26.4.

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Severity

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-407
Published: 2026-06-02
Modified: 2026-07-22
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GO-2026-5038	Go	stdlib	<1.25.11 >=1.26.0-0 <1.26.4	1.25.11, 1.26.4