{"id":"CVE-2026-42504","title":"Quadratic complexity in WordDecoder.DecodeHeader in mime","summary":"Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"adp","cwe":["CWE-407"],"vendor":"Go standard library","product":"mime","affected":["mime < 1.25.11","mime >= 1.26.0-0 < 1.26.4"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-06-03T14:05:39.682615Z"},"published":"2026-06-02","updated":"2026-10-28","sourceUpdated":"2026-10-28T16:24:17.133Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-42504","references":[{"url":"https://go.dev/issue/79217"},{"url":"https://go.dev/cl/774481"},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"},{"url":"https://pkg.go.dev/vuln/GO-2026-5038"}],"tags":["cve.org","osv","go"],"epss":0.0056,"epssPercentile":0.46507,"aliases":["GO-2026-5038","BIT-golang-2026-42504"],"ecosystem":"go","patched":["stdlib 1.26.4"],"ingestedAt":"2026-07-16T18:59:42.756Z","slug":"CVE-2026-42504","body":"## Overview\n\nDecoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.\n\n## Affected\n\n- `mime < 1.25.11`\n- `mime >= 1.26.0-0 < 1.26.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-42504)\n\nAffected packages:\n\n- `stdlib >= 1.26.0-0, < 1.26.4`\n\nPatched in:\n\n- `stdlib 1.26.4`\n\nSource: https://osv.dev/vulnerability/GO-2026-5038","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":8179,"id":"CVE-2026-42504","ts":1788919966869,"field":"cvss","old":null,"new":"7.5"},{"seq":8178,"id":"CVE-2026-42504","ts":1788919966869,"field":"severity","old":"none","new":"high"},{"seq":7988,"id":"CVE-2026-42504","ts":1788919254165,"field":"cvss","old":"7.5","new":null},{"seq":7987,"id":"CVE-2026-42504","ts":1788919254165,"field":"severity","old":"high","new":"none"},{"seq":7797,"id":"CVE-2026-42504","ts":1788916327778,"field":"cvss","old":null,"new":"7.5"},{"seq":7796,"id":"CVE-2026-42504","ts":1788916327778,"field":"severity","old":"none","new":"high"},{"seq":7606,"id":"CVE-2026-42504","ts":1788915271786,"field":"cvss","old":"7.5","new":null},{"seq":7605,"id":"CVE-2026-42504","ts":1788915271786,"field":"severity","old":"high","new":"none"},{"seq":7415,"id":"CVE-2026-42504","ts":1788912687309,"field":"cvss","old":null,"new":"7.5"},{"seq":7414,"id":"CVE-2026-42504","ts":1788912687309,"field":"severity","old":"none","new":"high"},{"seq":7224,"id":"CVE-2026-42504","ts":1788911304117,"field":"cvss","old":"7.5","new":null},{"seq":7223,"id":"CVE-2026-42504","ts":1788911304117,"field":"severity","old":"high","new":"none"},{"seq":7031,"id":"CVE-2026-42504","ts":1788909056193,"field":"cvss","old":null,"new":"7.5"},{"seq":7030,"id":"CVE-2026-42504","ts":1788909056193,"field":"severity","old":"none","new":"high"},{"seq":6843,"id":"CVE-2026-42504","ts":1788907368370,"field":"cvss","old":"7.5","new":null},{"seq":6842,"id":"CVE-2026-42504","ts":1788907368370,"field":"severity","old":"high","new":"none"},{"seq":6819,"id":"CVE-2026-42504","ts":1788905597542,"field":"cvss","old":null,"new":"7.5"},{"seq":6818,"id":"CVE-2026-42504","ts":1788905597542,"field":"severity","old":"none","new":"high"}]}