CVE-2026-42504: Quadratic complexity in WordDecoder.DecodeHeader in mime
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Other sources
Quadratic complexity in WordDecoder.DecodeHeader in mime
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.26.4-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42504?
The severity of CVE-2026-42504 is rated as high with a CVSS score of 7.5.
What are the potential impacts of CVE-2026-42504?
CVE-2026-42504 can lead to excessive CPU consumption when decoding a maliciously-crafted MIME header.
How do I fix CVE-2026-42504?
To fix CVE-2026-42504, it is recommended to update to the latest version of the Go mime package that addresses this issue.
What versions of the Go mime package are affected by CVE-2026-42504?
CVE-2026-42504 affects versions of the Go mime package before the patch is applied in the update.
Is there a workaround for CVE-2026-42504?
Currently, there are no specific workarounds for CVE-2026-42504 other than updating to the fixed version.