{"id":"CVE-2026-42504","aliases":["GO-2026-5038","BIT-golang-2026-42504"],"title":"Quadratic complexity in WordDecoder.DecodeHeader in mime","summary":"Quadratic complexity in WordDecoder.DecodeHeader in mime","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"stdlib","product":"stdlib","ecosystem":"go","affected":["stdlib >= 1.26.0-0, < 1.26.4"],"patched":["stdlib 1.26.4"],"published":"2026-06-02","updated":"2026-09-18","sourceUpdated":"2026-09-18T10:41:38.257292439Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-5038","references":[{"url":"https://go.dev/issue/79217"},{"url":"https://go.dev/cl/774481"},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"},{"url":"https://pkg.go.dev/vuln/GO-2026-5038"}],"tags":["osv","go","cve.org"],"epss":0.0056,"epssPercentile":0.4517,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-06-03T14:05:39.682615Z"},"cvssSource":"adp","cwe":["CWE-407"],"ingestedAt":"2026-07-16T18:59:42.756Z","slug":"CVE-2026-42504","body":"## Overview\n\nDecoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.\n\n## Affected packages\n\n- `stdlib >= 1.26.0-0, < 1.26.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `stdlib 1.26.4`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":8179,"id":"CVE-2026-42504","ts":1788919966869,"field":"cvss","old":null,"new":"7.5"},{"seq":8178,"id":"CVE-2026-42504","ts":1788919966869,"field":"severity","old":"none","new":"high"},{"seq":7988,"id":"CVE-2026-42504","ts":1788919254165,"field":"cvss","old":"7.5","new":null},{"seq":7987,"id":"CVE-2026-42504","ts":1788919254165,"field":"severity","old":"high","new":"none"},{"seq":7797,"id":"CVE-2026-42504","ts":1788916327778,"field":"cvss","old":null,"new":"7.5"},{"seq":7796,"id":"CVE-2026-42504","ts":1788916327778,"field":"severity","old":"none","new":"high"},{"seq":7606,"id":"CVE-2026-42504","ts":1788915271786,"field":"cvss","old":"7.5","new":null},{"seq":7605,"id":"CVE-2026-42504","ts":1788915271786,"field":"severity","old":"high","new":"none"},{"seq":7415,"id":"CVE-2026-42504","ts":1788912687309,"field":"cvss","old":null,"new":"7.5"},{"seq":7414,"id":"CVE-2026-42504","ts":1788912687309,"field":"severity","old":"none","new":"high"},{"seq":7224,"id":"CVE-2026-42504","ts":1788911304117,"field":"cvss","old":"7.5","new":null},{"seq":7223,"id":"CVE-2026-42504","ts":1788911304117,"field":"severity","old":"high","new":"none"},{"seq":7031,"id":"CVE-2026-42504","ts":1788909056193,"field":"cvss","old":null,"new":"7.5"},{"seq":7030,"id":"CVE-2026-42504","ts":1788909056193,"field":"severity","old":"none","new":"high"},{"seq":6843,"id":"CVE-2026-42504","ts":1788907368370,"field":"cvss","old":"7.5","new":null},{"seq":6842,"id":"CVE-2026-42504","ts":1788907368370,"field":"severity","old":"high","new":"none"},{"seq":6819,"id":"CVE-2026-42504","ts":1788905597542,"field":"cvss","old":null,"new":"7.5"},{"seq":6818,"id":"CVE-2026-42504","ts":1788905597542,"field":"severity","old":"none","new":"high"}]}