Mime
Monthly
Algorithmic complexity denial of service in the Go standard library's mime package allows remote unauthenticated attackers to consume excessive CPU by submitting MIME headers containing many invalid encoded-words. Affected Go releases include mime versions before 1.25.11 and 1.26.0-0 through versions prior to 1.26.4, with a patch available from upstream Go. EPSS is very low (0.02%, 5th percentile) and there is no public exploit identified at time of analysis, but the network-reachable, no-auth attack surface makes this relevant for any Go service that parses untrusted MIME input.
Algorithmic complexity denial of service in the Go standard library's mime package allows remote unauthenticated attackers to consume excessive CPU by submitting MIME headers containing many invalid encoded-words. Affected Go releases include mime versions before 1.25.11 and 1.26.0-0 through versions prior to 1.26.4, with a patch available from upstream Go. EPSS is very low (0.02%, 5th percentile) and there is no public exploit identified at time of analysis, but the network-reachable, no-auth attack surface makes this relevant for any Go service that parses untrusted MIME input.