Injection Vulnerability in Go Programming's net/textproto Package

CVE-2026-42507

What is CVE-2026-42507?

The net/textproto package in Go can potentially expose systems to content injection risks due to its error handling mechanisms. When errors are returned, the functions might include user input in their responses, allowing attackers to manipulate error logs or printed messages. This vulnerability can lead to the injection of misleading content, complicating incident response and analysis. Proper scrutiny of user inputs in these error messages is essential to mitigate the risks associated with this vulnerability.

References