Go standard library EUVD-2026-95423

Exploitation requires that the target application parse untrusted multipart/form-data input using Go's mime/multipart (e.g., via net/http Request.ParseMultipartForm / Request.FormFile) on an affected runtime (Go <1.27.2 or <1.26.9). The specific trigger is that the remaining multipart memory limit at the start of a part must be less than 400 bytes, at which point an arbitrarily long line is read into memory bypassing the cap - an attacker can shape the request to reach this state, so it is not a non-default configuration but an inherent parser condition. The practical limiting factor is exposure: only services that accept and parse attacker-supplied multipart forms are reachable; purely internal or non-multipart endpoints are not affected, and applying the patched Go version fully removes the condition.

This is a memory-exhaustion denial-of-service flaw (CWE-770) in the Go standard library's mime/multipart and net/textproto packages, where multipart form parsing can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is under 400 bytes. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) indicates remote, unauthenticated, low-complexity exploitation with high availability impact and no confidentiality/integrity impact - fully consistent with a DoS. Signals are coherent but point to a moderate, not urgent, priority: EPSS is low (0.18%, 7th percentile), SSVC reports Exploitation=none (no observed exploitation) and Technical Impact=partial, and the vulnerability is NOT in CISA KEV. The one amplifying signal is SSVC Automatable=yes, meaning the attack can be scripted and fired broadly against any exposed multipart endpoint. Net: a genuinely widespread but low-severity-outcome issue (resource exhaustion, not RCE or data loss) affecting a ubiquitous language runtime - patch it as routine dependency hygiene rather than emergency response, prioritizing internet-facing Go services that accept file/form uploads.

An attacker sends a crafted multipart/form-data HTTP request to any internet-facing Go service that parses multipart forms (e.g., a file-upload or form endpoint), structuring parts so the remaining memory limit at the start of a part falls below 400 bytes, then supplying an extremely long header line. The parser bypasses the intended memory cap and buffers the oversized line, driving memory consumption up and potentially crashing the process or causing OOM-based service disruption. No public exploit identified at time of analysis, but the condition is attacker-controllable and SSVC flags the attack as automatable.