CVE-2026-42504

high

Published 2026-06-02 · Modified 2026-06-03

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

7.5

Description

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Predictions

Exploit likelihood

83%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2026-42504 NameCVE-2026-42504 DescriptionDecoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) Vulnerable and fixed packages The table below lists information on source packages.…

CVE-2026-42504

Name	CVE-2026-42504
Description	Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-1.15 (PTS)	bullseye	1.15.15-1~deb11u4	vulnerable
golang-1.19 (PTS)	bookworm	1.19.8-2	vulnerable
golang-1.24 (PTS)	trixie	1.24.4-1	vulnerable
golang-1.25 (PTS)	forky, sid	1.25.10-2	vulnerable
golang-1.26 (PTS)	forky, sid	1.26.3-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
golang-1.15	source	(unstable)	(unfixed)
golang-1.19	source	(unstable)	(unfixed)
golang-1.24	source	(unstable)	(unfixed)
golang-1.25	source	(unstable)	(unfixed)
golang-1.26	source	(unstable)	(unfixed)

Notes

https://github.com/golang/go/issues/79217
https://github.com/golang/go/commit/7f24db453a60faf6a3546d60bb02917a0a7aace0 (go1.26.4)
https://github.com/golang/go/commit/b79e0339290e14b3b2de1dc4942b8a88701ddb02 (go1.25.11)

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

https://github.com/golang/go/issues/79217https://github.com/golang/go/commit/7f24db453a60faf6a3546d60bb02917a0a7aace0 (go1.26.4)https://github.com/golang/go/commit/b79e0339290e14b3b2de1dc4942b8a88701ddb02 (go1.25.11)

OS impact

Debian Affected 5 releases

Version	Status	Fixed in
trixie	Affected	—
sid	Affected	—
forky	Affected	—
bullseye	Affected	—
bookworm	Affected	—

SUSE Affected 1 release

Version	Status	Fixed in
—	Affected	—

Package impact

Ecosystem	Package	Vulnerable	Fixed
Go	stdlib	`>=1.26.0-0,<1.26.4`	`1.25.11`

References

CWEs

CWE-407: CWE-407

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.