CVE-2026-42504: Go Standard Library Mime

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Affected products

• Go Standard Library Mime: before 1.25.11 (fixed in 1.25.11); from 1.26.0-0, before 1.26.4 (fixed in 1.26.4)

Published 2026-06-02. Last modified 2026-07-22.