Vulnerability GO-2026-5038
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 months ago
June 02, 2026 at 09:39 PM UTC
Quadratic complexity in WordDecoder.DecodeHeader in mime
<1.25.11, >=1.26.0-0 <1.26.4
<1.25.11, >=1.26.0-0 <1.26.4
Summary
Quadratic complexity in WordDecoder.DecodeHeader in mime
Details
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
10 days ago
Reset context tracking on consecutive template expressions in html/template
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599
Unknown
10 days ago
Recognize yield as regexp preceder keyword in html/template
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600
Unknown
10 days ago
HTTP/2 server memory exhaustion due to Trailer headers in net/http
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603
Unknown
10 days ago
Root.Mkdir(All) can follow junctions out of the root on Windows in os
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6604
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6604
Unknown
10 days ago
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6605
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6605
Impacted packages
Timeline
Published
4 months ago
June 02, 2026 at 09:39 PM UTC
Last Modified
3 days ago
October 15, 2026 at 10:41 AM UTC