---
id: CVE-2026-42504
aliases:
  - GO-2026-5038
  - BIT-golang-2026-42504
title: Quadratic complexity in WordDecoder.DecodeHeader in mime
summary: Quadratic complexity in WordDecoder.DecodeHeader in mime
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: stdlib
product: stdlib
ecosystem: go
affected:
  - 'stdlib >= 1.26.0-0, < 1.26.4'
patched:
  - stdlib 1.26.4
published: '2026-06-02'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T10:41:53.078712691Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-5038'
references:
  - url: 'https://go.dev/issue/79217'
  - url: 'https://go.dev/cl/774481'
  - url: 'https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw'
  - url: 'https://pkg.go.dev/vuln/GO-2026-5038'
tags:
  - osv
  - go
  - cve.org
epss: 0.0056
epssPercentile: 0.44281
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-03T14:05:39.682615Z'
cvssSource: adp
cwe:
  - CWE-407
ingestedAt: '2026-07-16T18:59:42.756Z'
---

## Overview

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

## Affected packages

- `stdlib >= 1.26.0-0, < 1.26.4`

## Remediation

Upgrade to a patched release:

- `stdlib 1.26.4`