CVE-2026-42507

5.3 mediumEPSS 0.4%

Medium (5.3). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in stdlib 1.25.11, 1.26.4.

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
Published: 2026-06-02
Modified: 2026-07-22
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GO-2026-5039	Go	stdlib	<1.25.11 >=1.26.0-0 <1.26.4	1.25.11, 1.26.4

References

https://go.dev/cl/777060
https://go.dev/issue/79346
https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
https://pkg.go.dev/vuln/GO-2026-5039

Check your stack JSON