CVE-2026-42507

MEDIUM 5.3

Arbitrary inputs are included in errors without any escaping in net/textproto

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

5th

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

Vendor	go standard library
Product	net/textproto
Published	Jun 2, 2026
Last Updated	Jun 3, 2026

Stay Ahead of the Next One

Get instant alerts for go standard library net/textproto

Be the first to know when new medium vulnerabilities affecting go standard library net/textproto are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Go standard library / net/textproto

0 < 1.25.11 1.26.0-0 < 1.26.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

go.dev: https://go.dev/issue/79346 go.dev: https://go.dev/cl/777060 groups.google.com: https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw pkg.go.dev: https://pkg.go.dev/vuln/GO-2026-5039