Multipart Form Vulnerability in Go Programming Language by Google
CVE-2026-94440

7.5HIGH

Key Information:

Vendor

Go Standard Library

Status
Net/textproto
Mime/multipart
Vendor
CVE Published:
8 October 2026

What is CVE-2026-94440?

An issue in the Go programming language's handling of multipart form data can result in a bypass of memory limits. When the initial segment of a multipart form part has less than 400 bytes remaining, it allows an attacker to read excessively long lines into memory, potentially leading to memory exhaustion and other unforeseen issues. This vulnerability emphasizes the importance of stringent input validation and careful management of memory limits in server-side applications.

Affected Version(s)

mime/multipart 0 < 1.26.9

mime/multipart 1.27.0-0 < 1.27.2

net/textproto 0 < 1.26.9

References

https://go.dev/cl/847307
https://go.dev/issue/81741
https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jakub Ciolek (https://ciolek.dev)
.