Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

CVE-2026-42504 is an algorithmic-complexity denial-of-service bug in Go's standard-library mime.WordDecoder.DecodeHeader, which decodes RFC 2047 MIME encoded-words in headers. A malicious header packed with many invalid encoded-words can force disproportionate CPU work because the pre-fix logic only skipped the opening =? on decode failure instead of advancing past the whole bad word. Upstream Go shipped fixes in go1.25.11 and go1.26.4 on **2026-06-02`; older or downstream builds may still be vulnerable unless the fix was backported.

There is no vendor CVSS baseline here, but reality does not support a panic-grade score. This is availability-only, requires attacker-controlled data to reach a fairly specific MIME-header decode path, and most Go services never touch that code at all. The places that should care are mail ingestion, IMAP/POP processing, MIME-heavy APIs, and any custom parser that feeds untrusted headers into mime.WordDecoder.

Why this verdict

• Started at a midrange DoS baseline because this is a remotely triggerable parser bug in the Go standard library, but it is availability-only and has no confidentiality or integrity impact.
• Exposure drops hard after the first prerequisite: the attacker needs untrusted MIME headers to reach mime.WordDecoder.DecodeHeader, which implies mail/MIME parsing or equivalent application logic rather than generic Go service exposure.
• Blast radius stays local to the parsing workload: the realistic outcome is worker saturation, backlog, or latency spikes, not tenant escape, credential theft, or code execution.

Why not higher?

There is no published evidence of exploitation, no KEV listing, and no sign this crosses over into memory corruption or control-flow hijack. Even in exposed environments, the attacker still needs a fairly specific parser path rather than merely reaching a TCP listener on any Go service.

Why not lower?

The bug is in the standard library, so the affected code is trustworthy-looking and can sit invisibly inside production mail or MIME workflows. If an internet-facing mail/API edge does parse attacker-controlled headers, exploitation is low-complexity and can translate directly into operational pain through CPU exhaustion.

1. Cap header size and header count — Reject or truncate oversized MIME headers before they reach Go parsing code. For a MEDIUM verdict there is no mitigation SLA—apply this as normal hardening while you work toward the 365-day remediation window, prioritizing internet-facing mail and ingestion tiers first.
2. Rate-limit untrusted mail and MIME ingestion — Throttle SMTP/API submitters, batch parsers, and queue consumers so a single sender cannot monopolize parser CPU. There is no mitigation SLA for this severity, but it is the best temporary brake if rebuilding affected services will take time.
3. Isolate parsing workers — Put MIME decoding in bounded worker pools with CPU/time limits, queue depth alerts, and failure isolation so a bad message burns one worker instead of the whole service. With a MEDIUM rating, do this through standard engineering change windows rather than emergency change control.
4. Rebuild and redeploy with fixed Go releases — For Go stdlib CVEs, patching the toolchain alone is not enough if your production binaries were already built with the vulnerable stdlib. Rebuild applications that parse untrusted MIME headers using Go 1.25.11, Go 1.26.4, or a confirmed downstream backport, inside the remediation window.

Run this on a build host, CI runner, or on a server that has either the Go toolchain or a target Go binary available. Invoke it as ./check-cve-2026-42504.sh to assess the installed toolchain, or ./check-cve-2026-42504.sh /path/to/binary to inspect a deployed Go executable via go version -m; no root is required, only read access to the toolchain or binary. This script is conservative: upstream version matches return VULNERABLE/PATCHED; older or distro-backported builds that cannot be proven one way or the other return UNKNOWN unless the patched source is visible.

#!/usr/bin/env bash
# check-cve-2026-42504.sh
# Determine likely exposure to CVE-2026-42504 in Go stdlib mime.WordDecoder.DecodeHeader.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

status="UNKNOWN"
reason=""

ver_ge() {
  # Compare semantic versions like 1.25.11 >= 1.25.9
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

ver_lt() {
  ! ver_ge "$1" "$2"
}

extract_go_version() {
  local target="${1:-}"
  local out ver

  if [ -n "$target" ]; then
    if ! command -v go >/dev/null 2>&1; then
      echo ""
      return 0
    fi
    out="$(go version -m "$target" 2>/dev/null | head -n1 || true)"
    ver="$(printf '%s' "$out" | grep -Eo 'go[0-9]+\.[0-9]+(\.[0-9]+)?' | head -n1 | sed 's/^go//')"
    printf '%s' "$ver"
    return 0
  fi

  if command -v go >/dev/null 2>&1; then
    out="$(go version 2>/dev/null || true)"
    ver="$(printf '%s' "$out" | grep -Eo 'go[0-9]+\.[0-9]+(\.[0-9]+)?' | head -n1 | sed 's/^go//')"
    printf '%s' "$ver"
    return 0
  fi

  echo ""
}

source_has_fix() {
  local goroot file
  goroot="${GOROOT:-}"
  if [ -z "$goroot" ] && command -v go >/dev/null 2>&1; then
    goroot="$(go env GOROOT 2>/dev/null || true)"
  fi
  file="$goroot/src/mime/encodedword.go"

  [ -f "$file" ] || return 1
  grep -Fq 'buf.WriteString(header[:end])' "$file" && grep -Fq 'header = header[end:]' "$file"
}

classify_version() {
  local v="$1"

  if [ -z "$v" ]; then
    status="UNKNOWN"
    reason="Could not determine Go version."
    return
  fi

  case "$v" in
    1.26.*)
      if ver_lt "$v" "1.26.4"; then
        status="VULNERABLE"
        reason="Upstream 1.26 branch is fixed in 1.26.4; found $v."
      else
        status="PATCHED"
        reason="Upstream 1.26 branch fixed in 1.26.4; found $v."
      fi
      ;;
    1.25.*)
      if ver_lt "$v" "1.25.11"; then
        status="VULNERABLE"
        reason="Upstream 1.25 branch is fixed in 1.25.11; found $v."
      else
        status="PATCHED"
        reason="Upstream 1.25 branch fixed in 1.25.11; found $v."
      fi
      ;;
    *)
      if source_has_fix; then
        status="PATCHED"
        reason="Installed source tree contains the backported fix in mime/encodedword.go."
      else
        status="UNKNOWN"
        reason="Version $v is not on an upstream fixed branch we can classify confidently, and no visible source backport was confirmed."
      fi
      ;;
  esac
}

target="${1:-}"
if [ -n "$target" ] && [ ! -r "$target" ]; then
  echo "UNKNOWN - Cannot read target: $target"
  exit 2
fi

version="$(extract_go_version "$target")"
classify_version "$version"

echo "$status - $reason"

case "$status" in
  PATCHED) exit 0 ;;
  VULNERABLE) exit 1 ;;
  *) exit 2 ;;
esac

Sources

1. Go release history
2. Go standard library source for `mime/encodedword.go`
3. Go code review listing showing release-branch fixes
4. Go release dashboard showing `mime` fix landing on supported branches
5. Go standard library package index showing published fixed stdlib version
6. Go `mime` package documentation
7. Yocto/OpenEmbedded backport for CVE-2026-42504
8. CISA Known Exploited Vulnerabilities Catalog