7.5 High

CVE-2026-42504 Quadratic complexity in WordDecoder.DecodeHeader in mime

Description

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
mime 1.26	1.26.0-0 → < 1.26.4	1.26.4
mime 1.25	earliest → < 1.25.11	1.25.11

References

go.dev go.dev
go.dev go.dev
groups.google.com groups.google.com
pkg.go.dev pkg.go.dev

Timeline

Published June 2, 2026
Last modified November 6, 2026

Track this CVE