5.3
Medium
CVE-2026-42507 When returning errors, functions in the net/textproto package would include its input as part of the error
Description
When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| net/textproto 1.26 | 1.26.0-0 → < 1.26.4 | 1.26.4 |
| net/textproto 1.25 | earliest → < 1.25.11 | 1.25.11 |
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of net/textproto
The 6 CVEs of net/textproto →
CVE-2026-94440
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit…
7.5
High
CVE-2025-61724
The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines
5.3
Medium
CVE-2023-45290
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue,…
6.5
Medium
CVE-2023-24534
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading…
7.5
High