Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-42504

37
FAUCET Score

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

First published: Jun 2, 2026Last modified: Jun 2, 2026

Impacted Technologies

VendorProductVersion(s)CPE
Go Standard LibraryMime
>= 0, < 1.25.11, >= 1.26.0-0, < 1.26.4CNA affecteddefault unaffected

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.56%
Probability of exploitation in next 30 days
EPSS Percentile
43.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0056 is in the 20th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (4)

microsoftpatch availablevia msrc
Product: azl3 golang 1.26.3-1 on Azure Linux 3.0Fixed in: 1.26.4-1
microsoftpatch availablevia msrc
Product: azl3 golang 1.26.4-3 on Azure Linux 3.0Fixed in: 1.26.4-1
microsoftpatch availablevia msrc
Product: 21423-17084Fixed in: 1.26.4-1
microsoftpatch availablevia msrc
Product: 21489-17084Fixed in: 1.26.4-1

Vendor Advisories (1)

microsoft2026-Jun/CVE-2026-42504Important

Quadratic complexity in WordDecoder.DecodeHeader in mime

Jun 4, 2026

References

go.dev / cl/774481
go.dev / issue/79217
groups.google.com / g/golang-announce/c/tKs3rmcBcKw
pkg.go.dev / vuln/GO-2026-5038