CVE-2026-42504 Overview
CVE-2026-42504 is a denial-of-service vulnerability in the Go standard library's MIME header decoding logic. Attackers can craft a MIME header containing many invalid encoded-words that forces the decoder into excessive CPU consumption. The flaw is categorized as an algorithmic complexity issue [CWE-407] and is reachable over the network without authentication or user interaction. Applications written in Go that parse untrusted email or MIME content — including mail servers, gateways, and HTTP services that handle MIME multipart payloads — are affected.
Critical Impact
A single malicious MIME header can exhaust CPU resources on Go-based services, degrading availability of mail processing and HTTP endpoints that decode MIME content.
Affected Products
- Go standard library mime package (tracked as GO-2026-5038)
- Go-based applications decoding untrusted MIME headers
- Mail processing services and gateways built on Go
Discovery Timeline
- 2026-06-02 - CVE-2026-42504 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-42504
Vulnerability Analysis
The vulnerability resides in the Go standard library's MIME header decoder, which processes RFC 2047 encoded-words of the form =?charset?encoding?encoded-text?=. When the decoder encounters a header containing a large number of invalid encoded-words, the parsing path performs work that scales poorly relative to the input size. An attacker submits a single header line packed with malformed tokens to trigger sustained CPU usage on the parsing thread.
Because MIME header decoding is invoked implicitly when handling email messages and multipart/* HTTP requests, the attack surface includes any Go service that accepts user-supplied MIME content. Repeated requests can saturate available cores and starve legitimate workloads. The condition affects availability only — confidentiality and integrity are not impacted.
Root Cause
The root cause is improper algorithmic complexity [CWE-407] in the mime.WordDecoder handling of invalid encoded-words. The decoder does not bound the work performed per header when many malformed tokens are present, allowing input size to translate into disproportionate processing time.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted MIME header — through SMTP, IMAP, HTTP multipart/form-data, or any protocol parsed by a vulnerable Go service — and the decoding routine consumes excessive CPU. The vulnerability mechanism is described in the upstream advisory rather than reproduced here. Refer to the Go.dev Issue Report and the Go.dev Vulnerability Advisory for technical details.
Detection Methods for CVE-2026-42504
Indicators of Compromise
- Sustained high CPU usage in Go processes that decode MIME content, especially correlated with inbound mail or HTTP multipart traffic.
- Inbound messages containing unusually long header lines with repeated =?...?= token fragments.
- Increased request latency or timeouts on endpoints accepting multipart/form-data or email submissions.
Detection Strategies
- Inspect mail and HTTP traffic for headers exceeding normal length thresholds and containing dense sequences of encoded-word delimiters.
- Profile Go services with pprof to identify time spent in mime.WordDecoder call paths during traffic spikes.
- Correlate CPU saturation alerts with request logs to identify the source IP submitting malformed MIME payloads.
Monitoring Recommendations
- Alert on per-process CPU utilization sustained above baseline on services that parse MIME content.
- Track request duration percentiles for endpoints accepting MIME bodies and flag tail latency regressions.
- Log and rate-limit clients submitting headers above a reasonable size or token-density threshold.
How to Mitigate CVE-2026-42504
Immediate Actions Required
- Upgrade to the Go release containing the fix referenced in the Go.dev Change Log Entry and rebuild affected binaries.
- Inventory Go-based services that parse MIME headers and prioritize patching internet-facing components first.
- Apply request size limits and reverse-proxy header length caps in front of vulnerable services.
Patch Information
The fix is tracked in the upstream Go project under issue 79217 and applied via change CL 774481. Consult the Golang Announce Group Update and the Go.dev Vulnerability Advisory for the patched Go versions. Rebuild all Go applications with the patched toolchain — runtime upgrades alone are insufficient because the mime package is statically linked.
Workarounds
- Enforce maximum header size limits at the network edge or reverse proxy before traffic reaches Go services.
- Reject or truncate MIME headers containing an abnormally high count of =? encoded-word markers.
- Apply CPU quotas and request timeouts to processes that decode untrusted MIME content to contain the impact.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
