---
id: CVE-2026-42504
title: Quadratic complexity in WordDecoder.DecodeHeader in mime
summary: >-
  Decoding a maliciously-crafted MIME header containing many invalid
  encoded-words can consume excessive CPU.
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
cwe:
  - CWE-407
vendor: Go standard library
product: mime
affected:
  - mime < 1.25.11
  - mime >= 1.26.0-0 < 1.26.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-03T14:05:39.682615Z'
published: '2026-06-02'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:24:17.133Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-42504'
references:
  - url: 'https://go.dev/issue/79217'
  - url: 'https://go.dev/cl/774481'
  - url: 'https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw'
  - url: 'https://pkg.go.dev/vuln/GO-2026-5038'
tags:
  - cve.org
  - osv
  - go
epss: 0.0056
epssPercentile: 0.46507
aliases:
  - GO-2026-5038
  - BIT-golang-2026-42504
ecosystem: go
patched:
  - stdlib 1.26.4
ingestedAt: '2026-07-16T18:59:42.756Z'
---

## Overview

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

## Affected

- `mime < 1.25.11`
- `mime >= 1.26.0-0 < 1.26.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-42504)

Affected packages:

- `stdlib >= 1.26.0-0, < 1.26.4`

Patched in:

- `stdlib 1.26.4`

Source: https://osv.dev/vulnerability/GO-2026-5038