CVE-2026-42504

Quadratic complexity in WordDecoder.DecodeHeader in mime

CVE-2026-42504 is fixed in 71 products on 2 platforms, first by Go Programming Language 1.26.4, released May 29, 2026. It is not reported as exploited. Patch Radar priority: High.

HighFixed on 2 platforms
CVSS
8.8
Important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0056
46th percentile

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Where it's fixed

ProductFixed inFixReleased
Windows apps
Go Programming Language 1.26.4 Go Programming Language 1.26.4 May 29, 2026
Linux
amazon-cloudwatch-agent · amzn 2023 1.300069.1-1.amzn2023 ALAS2023-2026-2025 Aug 3, 2026
compat-golang-github-cpuguy83-md2man-2-devel · amzn 2023 2.0.2-24.amzn2023.0.8 ALAS2023-2026-1875 Jun 22, 2026
containerd · amzn 2023 2.2.5-1.amzn2023.0.1 ALAS2023-2026-1909 Jul 6, 2026
containerd-debuginfo · amzn 2023 2.2.5-1.amzn2023.0.1 ALAS2023-2026-1909 Jul 6, 2026
containerd-debugsource · amzn 2023 2.2.5-1.amzn2023.0.1 ALAS2023-2026-1909 Jul 6, 2026
containerd-stress · amzn 2023 2.2.5-1.amzn2023.0.1 ALAS2023-2026-1909 Jul 6, 2026
containerd-stress-debuginfo · amzn 2023 2.2.5-1.amzn2023.0.1 ALAS2023-2026-1909 Jul 6, 2026
credentials-fetcher · amzn 2023 2.0.3-1.amzn2023.0.1 ALAS2023-2026-1885 Jun 22, 2026
delve · RHEL 8 0:1.26.1-1.module+el8.10.0+24516+40554724 RHSA-2026:38995 Jul 14, 2026
delve · almalinux 8 1.26.1-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
docker · amzn 2023 25.0.16-1.amzn2023.0.3 ALAS2023-2026-1901 Jul 6, 2026
docker-debuginfo · amzn 2023 25.0.16-1.amzn2023.0.3 ALAS2023-2026-1901 Jul 6, 2026
docker-debugsource · amzn 2023 25.0.16-1.amzn2023.0.3 ALAS2023-2026-1901 Jul 6, 2026
ecs-init · amzn 2023 1.105.0-1.amzn2023 ALAS2023-2026-1902 Jul 6, 2026
flightctl · RHEL 10 1.1.4-1.el10em RHSA-2026:68334 Sep 17, 2026
go-fdo-client · RHEL 10 1.0.0-4.el10_2.7 RHSA-2026:62577 Sep 4, 2026
go-fdo-client · almalinux 10 1.0.0-4.el10_2.7 ALSA-2026:62577 Sep 2, 2026
go-toolset · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
go-toolset · RHEL 9 0:1.26.4-1.el9_8 RHSA-2026:29981 Jun 29, 2026
go-toolset · almalinux 10 1.26.4-1.el10_2.alma.1 ALSA-2026:29980 Jun 25, 2026
go-toolset · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
go-toolset · almalinux 9 1.26.4-1.el9_8 ALSA-2026:29981 Jun 25, 2026
go1.25 · opensuse-leap 16.0 1.25.11-160000.1.1 OPENSUSE-SU-2026:20977-1 Jun 17, 2026
go1.25 · sles 15.6 1.25.11-150000.1.41.1 SUSE-SU-2026:2326-1 Jun 9, 2026
go1.25 · sles 15.7 1.25.11-150000.1.41.1 SUSE-SU-2026:2326-1 Jun 9, 2026
go1.25 · sles 16.0 1.25.11-160000.1.1 SUSE-SU-2026:22155-1 Jun 17, 2026
go1.25-openssl · opensuse-leap 16.0 1.25.12-160000.1.1 OPENSUSE-SU-2026:21319-1 Jul 13, 2026
go1.25-openssl · sles 15.6 1.25.12-150600.13.21.1 SUSE-SU-2026:3151-1 Jul 21, 2026
go1.25-openssl · sles 15.7 1.25.12-150600.13.21.1 SUSE-SU-2026:3151-1 Jul 21, 2026
go1.25-openssl · sles 16.0 1.25.12-160000.1.1 SUSE-SU-2026:22638-1 Jul 13, 2026
go1.26 · opensuse-leap 16.0 1.26.4-160000.1.1 OPENSUSE-SU-2026:20976-1 Jun 17, 2026
go1.26 · sles 15.6 1.26.4-150000.1.15.1 SUSE-SU-2026:2327-1 Jun 9, 2026
go1.26 · sles 15.7 1.26.4-150000.1.15.1 SUSE-SU-2026:2327-1 Jun 9, 2026
go1.26 · sles 16.0 1.26.4-160000.1.1 SUSE-SU-2026:22154-1 Jun 17, 2026
go1.26-openssl · opensuse-leap 16.0 1.26.4-160000.1.1 OPENSUSE-SU-2026:21254-1 Jul 7, 2026
go1.26-openssl · sles 15.6 1.26.5-150600.13.9.1 SUSE-SU-2026:3102-1 Jul 17, 2026
go1.26-openssl · sles 15.7 1.26.5-150600.13.9.1 SUSE-SU-2026:3102-1 Jul 17, 2026
go1.26-openssl · sles 16.0 1.26.4-160000.1.1 SUSE-SU-2026:22572-1 Jul 7, 2026
golang · RHEL 10 1.26.7-1.el10_0 RHSA-2026:61882 Aug 1, 2026
golang · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
golang · RHEL 9 0:1.26.4-1.el9_8 RHSA-2026:29981 Jun 29, 2026
golang · almalinux 10 1.26.4-1.el10_2.alma.1 ALSA-2026:29980 Jun 25, 2026
golang · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
golang · almalinux 9 1.26.4-1.el9_8 ALSA-2026:29981 Jun 25, 2026
golang · amzn 2023 1.25.11-1.amzn2023.0.1 ALAS2023-2026-1878 Jun 22, 2026
golang-1.26 · Debian 14 1.26.4-1 DEBIAN-CVE-2026-42504 Jun 24, 2026
golang-bin · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
golang-bin · RHEL 9 0:1.26.4-1.el9_8 RHSA-2026:29981 Jun 29, 2026
golang-bin · almalinux 10 1.26.4-1.el10_2.alma.1 ALSA-2026:29980 Jun 25, 2026
golang-bin · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
golang-bin · almalinux 9 1.26.4-1.el9_8 ALSA-2026:29981 Jun 25, 2026
golang-bin · amzn 2023 1.25.11-1.amzn2023.0.1 ALAS2023-2026-1878 Jun 22, 2026
golang-docs · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
golang-docs · RHEL 9 0:1.26.4-1.el9_8 RHSA-2026:29981 Jun 29, 2026
golang-docs · almalinux 10 1.26.4-1.el10_2.alma.1 ALSA-2026:29980 Jun 25, 2026
golang-docs · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
golang-docs · almalinux 9 1.26.4-1.el9_8 ALSA-2026:29981 Jun 25, 2026
golang-docs · amzn 2023 1.25.11-1.amzn2023.0.1 ALAS2023-2026-1878 Jun 22, 2026
golang-github-burntsushi-toml · amzn 2023 1.5.0-1.amzn2023.0.2 ALAS2023-2026-1877 Jun 22, 2026
golang-github-burntsushi-toml-debuginfo · amzn 2023 1.5.0-1.amzn2023.0.2 ALAS2023-2026-1877 Jun 22, 2026
golang-github-burntsushi-toml-debugsource · amzn 2023 1.5.0-1.amzn2023.0.2 ALAS2023-2026-1877 Jun 22, 2026
golang-github-burntsushi-toml-devel · amzn 2023 1.5.0-1.amzn2023.0.2 ALAS2023-2026-1877 Jun 22, 2026
golang-github-burntsushi-toml-test · amzn 2023 0.2.0-8.amzn2023.0.4 ALAS2023-2026-1876 Jun 22, 2026
golang-github-burntsushi-toml-test-debuginfo · amzn 2023 0.2.0-8.amzn2023.0.4 ALAS2023-2026-1876 Jun 22, 2026
golang-github-burntsushi-toml-test-debugsource · amzn 2023 0.2.0-8.amzn2023.0.4 ALAS2023-2026-1876 Jun 22, 2026
golang-github-burntsushi-toml-test-devel · amzn 2023 0.2.0-8.amzn2023.0.4 ALAS2023-2026-1876 Jun 22, 2026
golang-github-cpuguy83-md2man · amzn 2023 2.0.2-24.amzn2023.0.8 ALAS2023-2026-1875 Jun 22, 2026
golang-github-cpuguy83-md2man-debuginfo · amzn 2023 2.0.2-24.amzn2023.0.8 ALAS2023-2026-1875 Jun 22, 2026
golang-github-cpuguy83-md2man-debugsource · amzn 2023 2.0.2-24.amzn2023.0.8 ALAS2023-2026-1875 Jun 22, 2026
golang-github-cpuguy83-md2man-devel · amzn 2023 2.0.2-24.amzn2023.0.8 ALAS2023-2026-1875 Jun 22, 2026
golang-github-openprinting-ipp-usb · RHEL 10 0.9.27-7.el10_2.3 RHSA-2026:62631 Sep 4, 2026
golang-github-openprinting-ipp-usb · rocky 10 0:0.9.27-7.el10_2.3 RLSA-2026:62631 Sep 3, 2026
golang-misc · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
golang-misc · RHEL 9 0:1.26.4-1.el9_8 RHSA-2026:29981 Jun 29, 2026
golang-misc · almalinux 10 1.26.4-1.el10_2.alma.1 ALSA-2026:29980 Jun 25, 2026
golang-misc · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
golang-misc · almalinux 9 1.26.4-1.el9_8 ALSA-2026:29981 Jun 25, 2026
golang-misc · amzn 2023 1.25.11-1.amzn2023.0.1 ALAS2023-2026-1878 Jun 22, 2026
golang-race · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
golang-race · RHEL 9 0:1.26.4-1.el9_8 RHSA-2026:29981 Jun 29, 2026
golang-race · almalinux 10 1.26.4-1.el10_2.alma.1 ALSA-2026:29980 Jun 25, 2026
golang-race · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
golang-race · almalinux 9 1.26.4-1.el9_8 ALSA-2026:29981 Jun 25, 2026
golang-shared · amzn 2023 1.25.11-1.amzn2023.0.1 ALAS2023-2026-1878 Jun 22, 2026
golang-src · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
golang-src · RHEL 9 0:1.26.4-1.el9_8 RHSA-2026:29981 Jun 29, 2026
golang-src · almalinux 10 1.26.4-1.el10_2.alma.1 ALSA-2026:29980 Jun 25, 2026
golang-src · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
golang-src · almalinux 9 1.26.4-1.el9_8 ALSA-2026:29981 Jun 25, 2026
golang-src · amzn 2023 1.25.11-1.amzn2023.0.1 ALAS2023-2026-1878 Jun 22, 2026
golang-tests · RHEL 8 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 RHSA-2026:38995 Jul 14, 2026
golang-tests · RHEL 9 0:1.26.4-1.el9_8 RHSA-2026:29981 Jun 29, 2026
golang-tests · almalinux 10 1.26.4-1.el10_2.alma.1 ALSA-2026:29980 Jun 25, 2026
golang-tests · almalinux 8 1.26.5-1.module_el8.10.0+4223+bd807c2e ALSA-2026:38995 Jul 13, 2026
golang-tests · almalinux 9 1.26.4-1.el9_8 ALSA-2026:29981 Jun 25, 2026
golang-tests · amzn 2023 1.25.11-1.amzn2023.0.1 ALAS2023-2026-1878 Jun 22, 2026
golist · amzn 2023 0.10.4-12.amzn2023.0.10 ALAS2023-2026-1874 Jun 22, 2026
golist-debuginfo · amzn 2023 0.10.4-12.amzn2023.0.10 ALAS2023-2026-1874 Jun 22, 2026
golist-debugsource · amzn 2023 0.10.4-12.amzn2023.0.10 ALAS2023-2026-1874 Jun 22, 2026
govulncheck-vulndb · opensuse-leap 16.0 0.0.20260723T184607-160000.1.1 OPENSUSE-SU-2026:21483-1 Jul 30, 2026
grafana · RHEL 10 10.2.6-26.el10_0 RHSA-2026:67517 Jul 6, 2026
grafana · RHEL 8 0:9.2.10-33.el8_10 RHSA-2026:62407 Sep 13, 2026
grafana · RHEL 9 0:10.2.6-23.el9_8.3 RHSA-2026:62406 Sep 13, 2026
grafana · almalinux 10 10.2.6-28.el10_2.5 ALSA-2026:63022 Sep 3, 2026
grafana · almalinux 8 9.2.10-33.el8_10 ALSA-2026:62407 Sep 2, 2026
grafana · almalinux 9 10.2.6-23.el9_8.3 ALSA-2026:62406 Sep 2, 2026
grafana-pcp · RHEL 10 5.3.0-1.el10_0 RHSA-2026:56143 Jun 2, 2026
grafana-pcp · RHEL 8 0:5.1.1-18.el8_10 RHSA-2026:63124 Sep 13, 2026
grafana-pcp · almalinux 10 5.3.0-8.el10_2.1 ALSA-2026:63119 Sep 3, 2026
grafana-pcp · almalinux 8 5.1.1-18.el8_10 ALSA-2026:63124 Sep 3, 2026
grafana-pcp · ol 10 0:5.3.0-8.el10_2.1 ELSA-2026-63119-0 Sep 3, 2026
grafana-pcp · ol 8 0:5.1.1-18.el8_10 ELSA-2026-63124-0 Sep 3, 2026
grafana-pcp · rocky 10 0:5.3.0-8.el10_2.1 RLSA-2026:63119 Sep 4, 2026
grafana-pcp · rocky 8 0:5.1.1-18.el8_10 RLSA-2026:63124 Sep 5, 2026
grafana-selinux · RHEL 8 0:9.2.10-33.el8_10 RHSA-2026:62407 Sep 13, 2026
grafana-selinux · RHEL 9 0:10.2.6-23.el9_8.3 RHSA-2026:62406 Sep 13, 2026
grafana-selinux · almalinux 10 10.2.6-28.el10_2.5 ALSA-2026:63022 Sep 3, 2026
grafana-selinux · almalinux 8 9.2.10-33.el8_10 ALSA-2026:62407 Sep 2, 2026
grafana-selinux · almalinux 9 10.2.6-23.el9_8.3 ALSA-2026:62406 Sep 2, 2026
image-builder · RHEL 10 52.1-1.el10_2.2 RHSA-2026:65534 Sep 10, 2026
image-builder · RHEL 9 0:52.1-1.el9_8.2 RHSA-2026:65886 Sep 13, 2026
image-builder · ol 10 0:72.0.0-1.0.2.el10 ELSA-2026-65534-0 Sep 11, 2026
image-builder · ol 9 0:72.0.0-1.0.2.el9 ELSA-2026-65886-0 Sep 11, 2026
image-builder · rocky 10 0:52.1-1.el10_2.2.rocky.0.1 RLSA-2026:65534 Sep 9, 2026
image-builder · rocky 9 0:52.1-1.el9_8.2 RLSA-2026:65886 Sep 10, 2026
ipp-usb · almalinux 10 0.9.27-7.el10_2.3 ALSA-2026:62631 Sep 2, 2026
ipp-usb · ol 10 0:0.9.27-7.el10_2.3 ELSA-2026-62631-0 Sep 2, 2026
nerdctl · amzn 2023 2.2.2-1.amzn2023.0.4 ALAS2023-2026-1908 Jul 6, 2026
openshift · RHEL 10 4.21.0-202608140338.p2.g7ffd39d.assembly.stream.el10 RHSA-2026:57456 Jun 2, 2026
openshift-clients · RHEL 10 4.21.0-202609071555.p2.gd0bf7cc.assembly.stream.el10 RHSA-2026:66350 Aug 13, 2026
opentelemetry-collector · RHEL 10 0.152.1-2.el10_0 RHSA-2026:67974 Sep 10, 2026
opentelemetry-collector · RHEL 9 0:0.152.1-2.el9_8 RHSA-2026:65117 Sep 13, 2026
opentelemetry-collector · almalinux 10 0.152.1-2.el10_2 ALSA-2026:65116 Sep 8, 2026
opentelemetry-collector · almalinux 9 0.152.1-2.el9_8 ALSA-2026:65117 Sep 8, 2026
opentelemetry-collector · rocky 10 0:0.152.1-2.el10_2 RLSA-2026:65116 Sep 9, 2026
opentelemetry-collector · rocky 9 0:0.152.1-2.el9_8 RLSA-2026:65117 Sep 9, 2026
osbuild-composer · RHEL 10 134.1-12.el10_0 RHSA-2026:66327 Sep 10, 2026
osbuild-composer · RHEL 8 0:101.5-3.el8_10 RHSA-2026:67148 Sep 19, 2026
osbuild-composer · RHEL 9 0:165.1-4.el9_8.1 RHSA-2026:65153 Sep 13, 2026
osbuild-composer · almalinux 8 101.5-3.el8_10.alma.1 ALSA-2026:67148 Sep 14, 2026
osbuild-composer · almalinux 9 165.1-4.el9_8.1.alma.1 ALSA-2026:65153 Sep 8, 2026
osbuild-composer · ol 10 0:176-1.0.2.el10_2 ELSA-2026-65895-0 Sep 11, 2026
osbuild-composer · ol 8 0:101.5-3.0.1.el8_10 ELSA-2026-67148-0 Sep 28, 2026
osbuild-composer · ol 9 0:175-1.0.2.el9_8 ELSA-2026-65153-0 Sep 11, 2026
osbuild-composer · rocky 10 0:165.1-3.el10_2.2.rocky.0.1 RLSA-2026:65895 Sep 10, 2026
osbuild-composer · rocky 8 0:101.5-3.el8_10.rocky.0.6 RLSA-2026:67148 Sep 15, 2026
osbuild-composer · rocky 9 0:165.1-4.el9_8.1.rocky.0.1 RLSA-2026:65153 Sep 9, 2026
osbuild-composer-core · RHEL 8 0:101.5-3.el8_10 RHSA-2026:67148 Sep 19, 2026
osbuild-composer-core · RHEL 9 0:165.1-4.el9_8.1 RHSA-2026:65153 Sep 13, 2026
osbuild-composer-core · almalinux 8 101.5-3.el8_10.alma.1 ALSA-2026:67148 Sep 14, 2026
osbuild-composer-core · almalinux 9 165.1-4.el9_8.1.alma.1 ALSA-2026:65153 Sep 8, 2026
osbuild-composer-core · ol 10 0:176-1.0.2.el10_2 ELSA-2026-65895-0 Sep 11, 2026
osbuild-composer-core · ol 8 0:101.5-3.0.1.el8_10 ELSA-2026-67148-0 Sep 28, 2026
osbuild-composer-core · ol 9 0:175-1.0.2.el9_8 ELSA-2026-65153-0 Sep 11, 2026
osbuild-composer-worker · RHEL 8 0:101.5-3.el8_10 RHSA-2026:67148 Sep 19, 2026
osbuild-composer-worker · RHEL 9 0:165.1-4.el9_8.1 RHSA-2026:65153 Sep 13, 2026
osbuild-composer-worker · almalinux 8 101.5-3.el8_10.alma.1 ALSA-2026:67148 Sep 14, 2026
osbuild-composer-worker · almalinux 9 165.1-4.el9_8.1.alma.1 ALSA-2026:65153 Sep 8, 2026
osbuild-composer-worker · ol 10 0:176-1.0.2.el10_2 ELSA-2026-65895-0 Sep 11, 2026
osbuild-composer-worker · ol 8 0:101.5-3.0.1.el8_10 ELSA-2026-67148-0 Sep 28, 2026
osbuild-composer-worker · ol 9 0:175-1.0.2.el9_8 ELSA-2026-65153-0 Sep 11, 2026
ose-azure-acr-image-credential-provider · RHEL 10 4.21.0-202609221600.p2.g53d73b1.assembly.stream.el10 RHSA-2026:71443 Aug 13, 2026
ose-crio-credential-provider · RHEL 10 4.21.0-202609021357.p2.g83d4961.assembly.stream.el10 RHSA-2026:66350 Aug 13, 2026
rclone · opensuse-leap 16.0 1.74.4-bp160.1.1 OPENSUSE-SU-2026:21436-1 Jul 22, 2026
receptor · RHEL 10 1.6.7-1.el10ap RHSA-2026:50336 Jun 2, 2026
rhc-worker-playbook · RHEL 10 0.2.10-1.el10_2 RHSA-2026:42946 Jun 2, 2026
runc · amzn 2023 1.3.6-1.amzn2023.0.1 ALAS2023-2026-2138 Sep 14, 2026
runc-debuginfo · amzn 2023 1.3.6-1.amzn2023.0.1 ALAS2023-2026-2138 Sep 14, 2026
runc-debugsource · amzn 2023 1.3.6-1.amzn2023.0.1 ALAS2023-2026-2138 Sep 14, 2026
runfinch-finch · amzn 2023 1.17.1-1.amzn2023.0.3 ALAS2023-2026-1886 Jun 22, 2026
soci-snapshotter · amzn 2023 0.14.1-1.amzn2023.0.1 ALAS2023-2026-1884 Jun 22, 2026
yggdrasil · RHEL 10 0.4.9.2-1.el10_2.3 RHSA-2026:69308 Aug 13, 2026
yggdrasil · almalinux 10 0.4.9.2-1.el10_2.3 ALSA-2026:69308 Sep 21, 2026
yggdrasil · ol 10 0:0.4.9.2-1.el10_2.3 ELSA-2026-69308 Sep 21, 2026
yggdrasil · rocky 10 0:0.4.9.2-1.el10_2.3 RLSA-2026:69308 Sep 22, 2026
yggdrasil-devel · almalinux 10 0.4.9.2-1.el10_2.3 ALSA-2026:69308 Sep 21, 2026
yggdrasil-devel · ol 10 0:0.4.9.2-1.el10_2.3 ELSA-2026-69308 Sep 21, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.