BIT-golang-2026-42507

vendorUSosv

Arbitrary inputs are included in errors without any escaping in net/textproto

view advisory published 2026-06-05Licence: per source

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-42507US	—	0.37% (31st)	—	2026-06-02
When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/777060WEB
https://go.dev/issue/79346WEB
https://groups.google.com/g/golang-announce/c/tKs3rmcBcKwWEB
https://nvd.nist.gov/vuln/detail/CVE-2026-42507WEB
https://pkg.go.dev/vuln/GO-2026-5039WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan