EUVD-2026-34039
GHSA-h524-452v-82p9
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionNVD
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
AnalysisAI
Algorithmic complexity denial of service in the Go standard library's mime package allows remote unauthenticated attackers to consume excessive CPU by submitting MIME headers containing many invalid encoded-words. Affected Go releases include mime versions before 1.25.11 and 1.26.0-0 through versions prior to 1.26.4, with a patch available from upstream Go. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all systems running Go with mime package versions <1.25.11 or 1.26.0 through <1.26.4, particularly those handling email or HTTP requests. Within 7 days: Upgrade affected systems to Go 1.25.11 or Go 1.26.4 or later. …
Sign in for detailed remediation steps.
More from same product – last 7 days
Path traversal in Jupyter Server 2.17.0 allows authenticated users to read and write files in sibling directories outsid
Heap out-of-bounds read in Sereal::Decoder for Perl before version 5.005 allows remote attackers to leak up to 31 bytes
Stack-based buffer overflow in rrdcached (the caching daemon for rrdtool) allows a local attacker with socket access to
Denial of service in FreeIPMI versions before 1.16.18 allows remote attackers to crash the ipmi-oem client by sending ma
Path traversal in the org.apache.sshd:sshd-git component of Apache MINA SSHD allows authenticated remote attackers to re
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today