Go mime package CVE-2026-42504

Upgrade to a fixed Go toolchain that bundles mime 1.25.11 or 1.26.4 (or later) and rebuild affected binaries - this is the primary fix and is referenced in the Go change at https://go.dev/cl/774481, the tracking issue https://go.dev/issue/79217, the golang-announce notice at https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw, and GO-2026-5038. Until rebuilt binaries are deployed, place CPU and request-time limits on services that parse MIME (per-request CPU budgets, goroutine timeouts via context.WithTimeout around mail.ReadMessage / mime.WordDecoder, and request-size caps on header fields) and front internet-exposed Go mail or HTTP endpoints with a WAF or proxy that rejects oversized or malformed MIME headers; the trade-off is that aggressive header-size limits may break legitimate but unusual mail with long subject lines or many encoded-word continuations.