CVE-2026-42507: Go Standard Library Net/textproto

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

Affected products

• Go Standard Library Net/textproto: before 1.25.11 (fixed in 1.25.11); from 1.26.0-0, before 1.26.4 (fixed in 1.26.4)

Published 2026-06-02. Last modified 2026-07-22.