Multipart Form Vulnerability in Go Programming Language by Google
CVE-2026-94440

Currently unrated

Key Information:

Vendor: Go Standard Library
Status: Net/textproto; Mime/multipart
Vendor: CVE Published:; 8 October 2026

🔔 Create Go Standard Library Vulnerability Alert

What is CVE-2026-94440?

An issue in the Go programming language's handling of multipart form data can result in a bypass of memory limits. When the initial segment of a multipart form part has less than 400 bytes remaining, it allows an attacker to read excessively long lines into memory, potentially leading to memory exhaustion and other unforeseen issues. This vulnerability emphasizes the importance of stringent input validation and careful management of memory limits in server-side applications.

Affected Version(s)

mime/multipart 0 < 1.26.9

mime/multipart 1.27.0-0 < 1.27.2

net/textproto 0 < 1.26.9

References

https://go.dev/cl/847307

https://go.dev/issue/81741

https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 8, 2026
Vulnerability Reserved
Sep 21, 2026

Credit

Jakub Ciolek (https://ciolek.dev)

CVE-2026-94440 Data

JSON