CVE-2026-42507: Arbitrary inputs are included in errors without any escaping in net/textproto
Arbitrary inputs are included in errors without any escaping in net/textproto
Other sources
When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.26.4-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42507?
CVE-2026-42507 has a medium severity rating of 5.3 on the CVSS scale.
What are the potential impacts of CVE-2026-42507?
CVE-2026-42507 could allow an attacker to inject misleading content into errors that are printed or logged.
How do I fix CVE-2026-42507?
To mitigate CVE-2026-42507, ensure that inputs are properly sanitized and escaped before being included in error messages.
Which software is affected by CVE-2026-42507?
CVE-2026-42507 affects the net/textproto package of golang.
When was CVE-2026-42507 published?
CVE-2026-42507 was published on June 2, 2026.