7.5
High
CVE-2026-94440 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit…
Description
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| net/textproto 1.27 | 1.27.0-0 → < 1.27.2 | 1.27.2 |
| net/textproto 1.26 | earliest → < 1.26.9 | 1.26.9 |
| mime/multipart 1.27 | 1.27.0-0 → < 1.27.2 | 1.27.2 |
| mime/multipart 1.26 | earliest → < 1.26.9 | 1.26.9 |
References
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of net/textproto
The 6 CVEs of net/textproto →
CVE-2026-42507
When returning errors, functions in the net/textproto package would include its input as part of the error
5.3
Medium
CVE-2025-61724
The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines
5.3
Medium
CVE-2023-45290
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue,…
6.5
Medium
CVE-2023-24534
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading…
7.5
High