CVE-2026-42507
Arbitrary inputs are included in errors without any escaping in net/textproto
CVE-2026-42507 is fixed in 51 products on 2 platforms, first by RHSA-2026:49702, released May 27, 2026. It is not reported as exploited. Patch Radar priority: Routine.
RoutineFixed on 2 platforms
CVSS
5.3
Moderate
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0037
31st percentile
When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Go Programming Language | 1.26.4 | Go Programming Language 1.26.4 | May 29, 2026 |
| Linux | |||
| amazon-cloudwatch-agent · amzn 2023 | 1.300069.1-1.amzn2023 | ALAS2023-2026-2025 | Aug 3, 2026 |
| compat-golang-github-cpuguy83-md2man-2-devel · amzn 2023 | 2.0.2-24.amzn2023.0.8 | ALAS2023-2026-1875 | Jun 22, 2026 |
| containerd · amzn 2023 | 2.2.5-1.amzn2023.0.1 | ALAS2023-2026-1909 | Jul 6, 2026 |
| containerd-debuginfo · amzn 2023 | 2.2.5-1.amzn2023.0.1 | ALAS2023-2026-1909 | Jul 6, 2026 |
| containerd-debugsource · amzn 2023 | 2.2.5-1.amzn2023.0.1 | ALAS2023-2026-1909 | Jul 6, 2026 |
| containerd-stress · amzn 2023 | 2.2.5-1.amzn2023.0.1 | ALAS2023-2026-1909 | Jul 6, 2026 |
| containerd-stress-debuginfo · amzn 2023 | 2.2.5-1.amzn2023.0.1 | ALAS2023-2026-1909 | Jul 6, 2026 |
| credentials-fetcher · amzn 2023 | 2.0.3-1.amzn2023.0.1 | ALAS2023-2026-1885 | Jun 22, 2026 |
| delve · RHEL 8 | 0:1.26.1-1.module+el8.10.0+24516+40554724 | RHSA-2026:38995 | Jul 14, 2026 |
| delve · almalinux 8 | 1.26.1-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 | Jul 13, 2026 |
| docker · amzn 2023 | 25.0.16-1.amzn2023.0.3 | ALAS2023-2026-1901 | Jul 6, 2026 |
| docker-debuginfo · amzn 2023 | 25.0.16-1.amzn2023.0.3 | ALAS2023-2026-1901 | Jul 6, 2026 |
| docker-debugsource · amzn 2023 | 25.0.16-1.amzn2023.0.3 | ALAS2023-2026-1901 | Jul 6, 2026 |
| ecs-init · amzn 2023 | 1.105.0-1.amzn2023 | ALAS2023-2026-1902 | Jul 6, 2026 |
| git-lfs · RHEL 9 | 0:3.7.1-4.el9_8.3 | RHSA-2026:66364 | Sep 13, 2026 |
| git-lfs · almalinux 9 | 3.7.1-4.el9_8.3 | ALSA-2026:66364 | Sep 10, 2026 |
| go-toolset · RHEL 8 | 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 | RHSA-2026:38995 | Jul 14, 2026 |
| go-toolset · RHEL 9 | 0:1.26.4-1.el9_8 | RHSA-2026:29981 | Jun 29, 2026 |
| go-toolset · almalinux 10 | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 | Jun 25, 2026 |
| go-toolset · almalinux 8 | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 | Jul 13, 2026 |
| go-toolset · almalinux 9 | 1.26.4-1.el9_8 | ALSA-2026:29981 | Jun 25, 2026 |
| go-toolset · ol 10 | 0:1.26.5-1.0.1.el10_2 | ELSA-2026-29980 | Jul 22, 2026 |
| go-toolset · ol 9 | 0:1.26.4-1.0.1.el9_8 | ELSA-2026-29981 | Jun 26, 2026 |
| go1.25 · opensuse-leap 16.0 | 1.25.11-160000.1.1 | OPENSUSE-SU-2026:20977-1 | Jun 17, 2026 |
| go1.25 · sles 15.6 | 1.25.11-150000.1.41.1 | SUSE-SU-2026:2326-1 | Jun 9, 2026 |
| go1.25 · sles 15.7 | 1.25.11-150000.1.41.1 | SUSE-SU-2026:2326-1 | Jun 9, 2026 |
| go1.25 · sles 16.0 | 1.25.11-160000.1.1 | SUSE-SU-2026:22155-1 | Jun 17, 2026 |
| go1.25-openssl · opensuse-leap 16.0 | 1.25.12-160000.1.1 | OPENSUSE-SU-2026:21319-1 | Jul 13, 2026 |
| go1.25-openssl · sles 15.6 | 1.25.12-150600.13.21.1 | SUSE-SU-2026:3151-1 | Jul 21, 2026 |
| go1.25-openssl · sles 15.7 | 1.25.12-150600.13.21.1 | SUSE-SU-2026:3151-1 | Jul 21, 2026 |
| go1.25-openssl · sles 16.0 | 1.25.12-160000.1.1 | SUSE-SU-2026:22638-1 | Jul 13, 2026 |
| go1.26 · opensuse-leap 16.0 | 1.26.4-160000.1.1 | OPENSUSE-SU-2026:20976-1 | Jun 17, 2026 |
| go1.26 · sles 15.6 | 1.26.4-150000.1.15.1 | SUSE-SU-2026:2327-1 | Jun 9, 2026 |
| go1.26 · sles 15.7 | 1.26.4-150000.1.15.1 | SUSE-SU-2026:2327-1 | Jun 9, 2026 |
| go1.26 · sles 16.0 | 1.26.4-160000.1.1 | SUSE-SU-2026:22154-1 | Jun 17, 2026 |
| go1.26-openssl · opensuse-leap 16.0 | 1.26.4-160000.1.1 | OPENSUSE-SU-2026:21254-1 | Jul 7, 2026 |
| go1.26-openssl · sles 15.6 | 1.26.5-150600.13.9.1 | SUSE-SU-2026:3102-1 | Jul 17, 2026 |
| go1.26-openssl · sles 15.7 | 1.26.5-150600.13.9.1 | SUSE-SU-2026:3102-1 | Jul 17, 2026 |
| go1.26-openssl · sles 16.0 | 1.26.4-160000.1.1 | SUSE-SU-2026:22572-1 | Jul 7, 2026 |
| golang · RHEL 10 | 1.26.5-1.el10_0 | RHSA-2026:49702 | May 27, 2026 |
| golang · RHEL 8 | 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 | RHSA-2026:38995 | Jul 14, 2026 |
| golang · RHEL 9 | 0:1.26.4-1.el9_8 | RHSA-2026:29981 | Jun 29, 2026 |
| golang · almalinux 10 | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 | Jun 25, 2026 |
| golang · almalinux 8 | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 | Jul 13, 2026 |
| golang · almalinux 9 | 1.26.4-1.el9_8 | ALSA-2026:29981 | Jun 25, 2026 |
| golang · amzn 2023 | 1.25.11-1.amzn2023.0.1 | ALAS2023-2026-1878 | Jun 22, 2026 |
| golang · ol 10 | 0:1.26.5-1.0.1.el10_2 | ELSA-2026-29980 | Jul 22, 2026 |
| golang · ol 9 | 0:1.26.4-1.0.1.el9_8 | ELSA-2026-29981 | Jun 26, 2026 |
| golang · rocky 10 | 0:1.26.4-1.el10_2 | RLSA-2026:29980 | Jun 26, 2026 |
| golang · rocky 9 | 0:1.26.4-1.el9_8 | RLSA-2026:29981 | Jun 26, 2026 |
| golang-1.26 · Debian 14 | 1.26.4-1 | DEBIAN-CVE-2026-42507 | Jun 24, 2026 |
| golang-bin · RHEL 8 | 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 | RHSA-2026:38995 | Jul 14, 2026 |
| golang-bin · RHEL 9 | 0:1.26.4-1.el9_8 | RHSA-2026:29981 | Jun 29, 2026 |
| golang-bin · almalinux 10 | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 | Jun 25, 2026 |
| golang-bin · almalinux 8 | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 | Jul 13, 2026 |
| golang-bin · almalinux 9 | 1.26.4-1.el9_8 | ALSA-2026:29981 | Jun 25, 2026 |
| golang-bin · amzn 2023 | 1.25.11-1.amzn2023.0.1 | ALAS2023-2026-1878 | Jun 22, 2026 |
| golang-bin · ol 10 | 0:1.26.5-1.0.1.el10_2 | ELSA-2026-29980 | Jul 22, 2026 |
| golang-bin · ol 9 | 0:1.26.4-1.0.1.el9_8 | ELSA-2026-29981 | Jun 26, 2026 |
| golang-docs · RHEL 8 | 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 | RHSA-2026:38995 | Jul 14, 2026 |
| golang-docs · RHEL 9 | 0:1.26.4-1.el9_8 | RHSA-2026:29981 | Jun 29, 2026 |
| golang-docs · almalinux 10 | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 | Jun 25, 2026 |
| golang-docs · almalinux 8 | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 | Jul 13, 2026 |
| golang-docs · almalinux 9 | 1.26.4-1.el9_8 | ALSA-2026:29981 | Jun 25, 2026 |
| golang-docs · amzn 2023 | 1.25.11-1.amzn2023.0.1 | ALAS2023-2026-1878 | Jun 22, 2026 |
| golang-docs · ol 10 | 0:1.26.5-1.0.1.el10_2 | ELSA-2026-29980 | Jul 22, 2026 |
| golang-docs · ol 9 | 0:1.26.4-1.0.1.el9_8 | ELSA-2026-29981 | Jun 26, 2026 |
| golang-github-burntsushi-toml · amzn 2023 | 1.5.0-1.amzn2023.0.2 | ALAS2023-2026-1877 | Jun 22, 2026 |
| golang-github-burntsushi-toml-debuginfo · amzn 2023 | 1.5.0-1.amzn2023.0.2 | ALAS2023-2026-1877 | Jun 22, 2026 |
| golang-github-burntsushi-toml-debugsource · amzn 2023 | 1.5.0-1.amzn2023.0.2 | ALAS2023-2026-1877 | Jun 22, 2026 |
| golang-github-burntsushi-toml-devel · amzn 2023 | 1.5.0-1.amzn2023.0.2 | ALAS2023-2026-1877 | Jun 22, 2026 |
| golang-github-burntsushi-toml-test · amzn 2023 | 0.2.0-8.amzn2023.0.4 | ALAS2023-2026-1876 | Jun 22, 2026 |
| golang-github-burntsushi-toml-test-debuginfo · amzn 2023 | 0.2.0-8.amzn2023.0.4 | ALAS2023-2026-1876 | Jun 22, 2026 |
| golang-github-burntsushi-toml-test-debugsource · amzn 2023 | 0.2.0-8.amzn2023.0.4 | ALAS2023-2026-1876 | Jun 22, 2026 |
| golang-github-burntsushi-toml-test-devel · amzn 2023 | 0.2.0-8.amzn2023.0.4 | ALAS2023-2026-1876 | Jun 22, 2026 |
| golang-github-cpuguy83-md2man · amzn 2023 | 2.0.2-24.amzn2023.0.8 | ALAS2023-2026-1875 | Jun 22, 2026 |
| golang-github-cpuguy83-md2man-debuginfo · amzn 2023 | 2.0.2-24.amzn2023.0.8 | ALAS2023-2026-1875 | Jun 22, 2026 |
| golang-github-cpuguy83-md2man-debugsource · amzn 2023 | 2.0.2-24.amzn2023.0.8 | ALAS2023-2026-1875 | Jun 22, 2026 |
| golang-github-cpuguy83-md2man-devel · amzn 2023 | 2.0.2-24.amzn2023.0.8 | ALAS2023-2026-1875 | Jun 22, 2026 |
| golang-misc · RHEL 8 | 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 | RHSA-2026:38995 | Jul 14, 2026 |
| golang-misc · RHEL 9 | 0:1.26.4-1.el9_8 | RHSA-2026:29981 | Jun 29, 2026 |
| golang-misc · almalinux 10 | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 | Jun 25, 2026 |
| golang-misc · almalinux 8 | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 | Jul 13, 2026 |
| golang-misc · almalinux 9 | 1.26.4-1.el9_8 | ALSA-2026:29981 | Jun 25, 2026 |
| golang-misc · amzn 2023 | 1.25.11-1.amzn2023.0.1 | ALAS2023-2026-1878 | Jun 22, 2026 |
| golang-misc · ol 10 | 0:1.26.5-1.0.1.el10_2 | ELSA-2026-29980 | Jul 22, 2026 |
| golang-misc · ol 9 | 0:1.26.4-1.0.1.el9_8 | ELSA-2026-29981 | Jun 26, 2026 |
| golang-race · RHEL 8 | 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 | RHSA-2026:38995 | Jul 14, 2026 |
| golang-race · RHEL 9 | 0:1.26.4-1.el9_8 | RHSA-2026:29981 | Jun 29, 2026 |
| golang-race · almalinux 10 | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 | Jun 25, 2026 |
| golang-race · almalinux 8 | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 | Jul 13, 2026 |
| golang-race · almalinux 9 | 1.26.4-1.el9_8 | ALSA-2026:29981 | Jun 25, 2026 |
| golang-race · ol 10 | 0:1.26.5-1.0.1.el10_2 | ELSA-2026-29980 | Jul 22, 2026 |
| golang-race · ol 9 | 0:1.26.4-1.0.1.el9_8 | ELSA-2026-29981 | Jun 26, 2026 |
| golang-shared · amzn 2023 | 1.25.11-1.amzn2023.0.1 | ALAS2023-2026-1878 | Jun 22, 2026 |
| golang-src · RHEL 8 | 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 | RHSA-2026:38995 | Jul 14, 2026 |
| golang-src · RHEL 9 | 0:1.26.4-1.el9_8 | RHSA-2026:29981 | Jun 29, 2026 |
| golang-src · almalinux 10 | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 | Jun 25, 2026 |
| golang-src · almalinux 8 | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 | Jul 13, 2026 |
| golang-src · almalinux 9 | 1.26.4-1.el9_8 | ALSA-2026:29981 | Jun 25, 2026 |
| golang-src · amzn 2023 | 1.25.11-1.amzn2023.0.1 | ALAS2023-2026-1878 | Jun 22, 2026 |
| golang-src · ol 10 | 0:1.26.5-1.0.1.el10_2 | ELSA-2026-29980 | Jul 22, 2026 |
| golang-src · ol 9 | 0:1.26.4-1.0.1.el9_8 | ELSA-2026-29981 | Jun 26, 2026 |
| golang-tests · RHEL 8 | 0:1.26.5-1.module+el8.10.0+24506+6809f2d9 | RHSA-2026:38995 | Jul 14, 2026 |
| golang-tests · RHEL 9 | 0:1.26.4-1.el9_8 | RHSA-2026:29981 | Jun 29, 2026 |
| golang-tests · almalinux 10 | 1.26.4-1.el10_2.alma.1 | ALSA-2026:29980 | Jun 25, 2026 |
| golang-tests · almalinux 8 | 1.26.5-1.module_el8.10.0+4223+bd807c2e | ALSA-2026:38995 | Jul 13, 2026 |
| golang-tests · almalinux 9 | 1.26.4-1.el9_8 | ALSA-2026:29981 | Jun 25, 2026 |
| golang-tests · amzn 2023 | 1.25.11-1.amzn2023.0.1 | ALAS2023-2026-1878 | Jun 22, 2026 |
| golang-tests · ol 10 | 0:1.26.5-1.0.1.el10_2 | ELSA-2026-29980 | Jul 22, 2026 |
| golang-tests · ol 9 | 0:1.26.4-1.0.1.el9_8 | ELSA-2026-29981 | Jun 26, 2026 |
| golist · amzn 2023 | 0.10.4-12.amzn2023.0.10 | ALAS2023-2026-1874 | Jun 22, 2026 |
| golist-debuginfo · amzn 2023 | 0.10.4-12.amzn2023.0.10 | ALAS2023-2026-1874 | Jun 22, 2026 |
| golist-debugsource · amzn 2023 | 0.10.4-12.amzn2023.0.10 | ALAS2023-2026-1874 | Jun 22, 2026 |
| govulncheck-vulndb · opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | OPENSUSE-SU-2026:21483-1 | Jul 30, 2026 |
| nerdctl · amzn 2023 | 2.2.2-1.amzn2023.0.4 | ALAS2023-2026-1908 | Jul 6, 2026 |
| rclone · opensuse-leap 16.0 | 1.74.4-bp160.1.1 | OPENSUSE-SU-2026:21436-1 | Jul 22, 2026 |
| runc · amzn 2023 | 1.3.6-1.amzn2023.0.1 | ALAS2023-2026-2138 | Sep 14, 2026 |
| runc-debuginfo · amzn 2023 | 1.3.6-1.amzn2023.0.1 | ALAS2023-2026-2138 | Sep 14, 2026 |
| runc-debugsource · amzn 2023 | 1.3.6-1.amzn2023.0.1 | ALAS2023-2026-2138 | Sep 14, 2026 |
| soci-snapshotter · amzn 2023 | 0.14.1-1.amzn2023.0.1 | ALAS2023-2026-1884 | Jun 22, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.