CVE-2026-42507: Go net/textproto Information Disclosure

CVE-2026-42507 Overview

CVE-2026-42507 affects the net/textproto package in the Go standard library. Functions in this package include attacker-controlled input as part of returned error messages. An attacker can inject misleading content into errors that downstream applications print or log. The flaw enables log injection and may deceive operators reviewing application logs or error output.

The vulnerability is tracked by the Go security team as GO-2026-5039. Its EPSS score sits at 0.029%, indicating a low probability of near-term exploitation. The defect is corrected in the Go change list referenced by the Go project advisory.

Critical Impact
Attackers can craft input that, when echoed back inside net/textproto error strings, injects forged log entries or misleading diagnostic messages into application logs.

Affected Products

Go standard library net/textproto package
Applications consuming net/textproto for MIME header, HTTP, NNTP, or SMTP-style parsing
Services that log or print errors returned by net/textproto functions

Discovery Timeline

2026-06-02 - CVE-2026-42507 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-42507

Vulnerability Analysis

The net/textproto package parses textual protocol elements such as MIME headers and line-based commands. When parsing fails, the package constructs error values that embed the offending input verbatim. Applications that log these errors then write attacker-controlled bytes into log streams without sanitization.

This behavior maps to log injection and error message information disclosure. An adversary can embed newline characters, ANSI escape sequences, or fabricated log prefixes inside header names or values. When the calling application logs the error using a standard logger, the malicious payload appears as if it were a legitimate log line.

The issue does not yield code execution or direct data exposure. The integrity impact stems from the ability to deceive operators, evade detection rules, or poison log-based analytics. The Go advisory GO-2026-5039 documents the affected functions and the corrective change.

Root Cause

The root cause is improper neutralization of input used in an error message. net/textproto returns errors whose Error() output concatenates raw input bytes without escaping control characters or bounding length. Callers reasonably assume error strings are safe to log, which the package does not guarantee.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends malformed textual protocol data — for example, an HTTP request with a header containing embedded \n followed by a forged log entry — to a Go service. When the server logs the parsing error, the forged entry is written as a separate log line. See the Go.dev Vulnerability Advisory and the Go.dev Change Log Entry for the exact functions and fix.

Detection Methods for CVE-2026-42507

Indicators of Compromise

Log entries containing unexpected newline, carriage return, or ANSI escape sequences inside fields originally sourced from net/textproto errors
Duplicate or out-of-sequence log timestamps suggesting injected lines between legitimate entries
Error messages containing protocol-control bytes such as \r\n followed by what appears to be a separate log record

Detection Strategies

Parse application logs and flag any entries where error-message fields contain control characters outside the printable ASCII range
Correlate inbound request payloads with subsequent log lines to identify echoed attacker-controlled bytes
Build SIEM rules that detect log records lacking expected structural fields, which suggests injection between legitimate entries

Monitoring Recommendations

Forward Go service logs to a centralized log pipeline that preserves raw bytes for forensic inspection
Alert on parsing-error spikes from net/textproto, net/http, net/mail, or net/smtp packages
Track Go runtime version inventory and flag hosts running unpatched releases

How to Mitigate CVE-2026-42507

Immediate Actions Required

Upgrade Go toolchains and rebuild affected services using the fixed Go release referenced in the Golang Announce Group Post
Audit code paths that log errors returned from net/textproto, net/http, net/mail, and net/smtp
Apply sanitization to all logged error strings until rebuilt binaries are deployed

Patch Information

The Go project published the fix in change list cl/777060 and tracks the issue as GO-2026-5039. Rebuild all Go binaries with a Go toolchain that includes the patch. Consult the Go.dev Issue Tracker Entry for the upstream discussion and the Go.dev Change Log Entry for code-level details.

Workarounds

Wrap calls into net/textproto and strip control characters from returned error strings before logging
Use structured logging libraries that escape or quote field values rather than concatenating raw error text
Rate-limit or reject inbound requests containing control characters in header names before parsing

bash

# Configuration example: sanitize error strings before logging in Go
# Replace direct logging of net/textproto errors with:
#   log.Printf("parse error: %q", err.Error())
# The %q verb safely quotes control characters and prevents log injection.