GO-2026-5039Published

Arbitrary inputs are included in errors without any escaping in net/textproto

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2026-42507

Published

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

Source published: 2 Jun 2026 22:01:37 UTC
Source modified: 3 Jun 2026 19:04:45 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

euvd · EUVD-2026-34040

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Jun 2, 2026, 10:01:37 PM

dateUpdated: Jun 3, 2026, 7:04:45 PM

33 related source bulletins · separate from aliases

openSUSE-SU-2026:21436-1: Security update for rclone

CVE-2025-68121 · CVE-2026-25680 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-27141 · CVE-2026-27145 · CVE-2026-32952 · CVE-2026-33809 · CVE-2026-33813 · CVE-2026-33814 · CVE-2026-39821 · CVE-2026-39824 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-41176 · CVE-2026-41179 · CVE-2026-42500 · CVE-2026-42502 · CVE-2026-42504 · CVE-2026-42506 · CVE-2026-42507 · CVE-2026-42508 · CVE-2026-44740 · CVE-2026-46595 · CVE-2026-46597 · CVE-2026-46598 · CVE-2026-49980 · CVE-2026-54572 · CVE-2026-59732 · CVE-2026-59733

RHSA-2026:57649: Red Hat Security Advisory: golang security update

CVE-2026-27137 · CVE-2026-27145 · CVE-2026-33810 · CVE-2026-33811 · CVE-2026-33814 · CVE-2026-39817 · CVE-2026-39819 · CVE-2026-39820 · CVE-2026-39821 · CVE-2026-39822 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-42499 · CVE-2026-42501 · CVE-2026-42504 · CVE-2026-42507

openSUSE-SU-2026:21254-1: Security update for go1.26-openssl

CVE-2026-27140 · CVE-2026-27143 · CVE-2026-27144 · CVE-2026-27145 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-32283 · CVE-2026-32288 · CVE-2026-32289 · CVE-2026-33810 · CVE-2026-33811 · CVE-2026-33814 · CVE-2026-39817 · CVE-2026-39819 · CVE-2026-39820 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-39836 · CVE-2026-42499 · CVE-2026-42501 · CVE-2026-42504 · CVE-2026-42507

WID-SEC-W-2026-1776: Golang Go: Mehrere Schwachstellen

CVE-2026-27145 · CVE-2026-42504 · CVE-2026-42507

RHSA-2026:91249: Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Neuron)

CVE-2025-69418 · CVE-2026-6653 · CVE-2026-11979 · CVE-2026-13346 · CVE-2026-25679 · CVE-2026-25680 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-27137 · CVE-2026-27138 · CVE-2026-27139 · CVE-2026-27141 · CVE-2026-27142 · CVE-2026-27145 · CVE-2026-28390 · CVE-2026-31790 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-32288 · CVE-2026-32289 · CVE-2026-33811 · CVE-2026-33814 · CVE-2026-34182 · CVE-2026-34183 · CVE-2026-39820 · CVE-2026-39822 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-39836 · CVE-2026-42499 · CVE-2026-42502 · CVE-2026-42504 · CVE-2026-42505 · CVE-2026-42506 · CVE-2026-42507 · CVE-2026-45445 · CVE-2026-45447 · CVE-2026-74860 · CVE-2026-86138 · CVE-2026-86140 · CVE-2026-86142 · CVE-2026-86143 · CVE-2026-86144 · CVE-2026-86145 · CVE-2026-89090 · CVE-2026-89161 · CVE-2026-103111 · CVE-2026-114406

openSUSE-SU-2026:10975-1: rclone-1.74.3-1.1 on GA media

CVE-2026-27145 · CVE-2026-42504 · CVE-2026-42507 · CVE-2026-49980

RHSA-2026:49712: Red Hat Security Advisory: golang security update

RHSA-2026:23262: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-27145 · CVE-2026-33811 · CVE-2026-33814 · CVE-2026-39820 · CVE-2026-39821 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-39836 · CVE-2026-42501 · CVE-2026-42504 · CVE-2026-42507 · CVE-2026-42508 · CVE-2026-46595

RHSA-2026:91248: Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Neuron)

CVE-2025-69418 · CVE-2026-6653 · CVE-2026-11979 · CVE-2026-13346 · CVE-2026-25679 · CVE-2026-25680 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-27137 · CVE-2026-27138 · CVE-2026-27139 · CVE-2026-27141 · CVE-2026-27142 · CVE-2026-27145 · CVE-2026-28390 · CVE-2026-31790 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-32288 · CVE-2026-32289 · CVE-2026-33811 · CVE-2026-33814 · CVE-2026-34182 · CVE-2026-34183 · CVE-2026-39820 · CVE-2026-39822 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-39836 · CVE-2026-42499 · CVE-2026-42502 · CVE-2026-42504 · CVE-2026-42505 · CVE-2026-42506 · CVE-2026-42507 · CVE-2026-44172 · CVE-2026-45445 · CVE-2026-45447 · CVE-2026-74860 · CVE-2026-86138 · CVE-2026-86140 · CVE-2026-86142 · CVE-2026-86143 · CVE-2026-86144 · CVE-2026-86145 · CVE-2026-89090 · CVE-2026-89161 · CVE-2026-103111 · CVE-2026-114406

SUSE-SU-2026:22572-1: Security update for go1.26-openssl

SUSE-SU-2026:22154-1: Security update for go1.26

CVE-2026-27145 · CVE-2026-42504 · CVE-2026-42507

openSUSE-SU-2026:20977-1: Security update for go1.25

CVE-2026-27145 · CVE-2026-42504 · CVE-2026-42507

RHSA-2026:66364: Red Hat Security Advisory: git-lfs security update

CVE-2026-33818 · CVE-2026-42505 · CVE-2026-42507 · CVE-2026-56860 · CVE-2026-56862

RHSA-2026:23264: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

RHSA-2026:61253: Red Hat Security Advisory: golang security update

RHSA-2026:91613: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

CVE-2026-27145 · CVE-2026-42504 · CVE-2026-42507

openSUSE-SU-2026:20976-1: Security update for go1.26

CVE-2026-27145 · CVE-2026-42504 · CVE-2026-42507

RHSA-2026:38995: Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update

CVE-2026-27145 · CVE-2026-39821 · CVE-2026-39822 · CVE-2026-42504 · CVE-2026-42505 · CVE-2026-42507

RHSA-2026:59556: Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.6 security update

CVE-2024-45336 · CVE-2025-22866 · CVE-2026-10059 · CVE-2026-12143 · CVE-2026-19130 · CVE-2026-27145 · CVE-2026-39825 · CVE-2026-42507 · CVE-2026-66794 · CVE-2026-66795 · CVE-2026-73266 · CVE-2026-73267 · CVE-2026-73268 · CVE-2026-73269

openSUSE-SU-2026:10960-1: go1.26-1.26.4-1.1 on GA media

CVE-2026-27145 · CVE-2026-42504 · CVE-2026-42507

RHSA-2026:29980: Red Hat Security Advisory: golang security, bug fix, and enhancement update

CVE-2026-27145 · CVE-2026-42504 · CVE-2026-42507

RHSA-2026:29981: Red Hat Security Advisory: golang security, bug fix, and enhancement update

CVE-2026-27145 · CVE-2026-42504 · CVE-2026-42507

openSUSE-SU-2026:21319-1: Security update for go1.25-openssl

CVE-2025-61732 · CVE-2025-68121 · CVE-2026-25679 · CVE-2026-27139 · CVE-2026-27140 · CVE-2026-27142 · CVE-2026-27143 · CVE-2026-27144 · CVE-2026-27145 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-32283 · CVE-2026-32288 · CVE-2026-32289 · CVE-2026-33811 · CVE-2026-33814 · CVE-2026-39817 · CVE-2026-39819 · CVE-2026-39820 · CVE-2026-39822 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-39836 · CVE-2026-42499 · CVE-2026-42501 · CVE-2026-42504 · CVE-2026-42505 · CVE-2026-42507

RHSA-2026:33612: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.10.1 release

CVE-2025-5278 · CVE-2026-42507 · CVE-2026-62147

SUSE-SU-2026:2326-1: Security update for go1.25

CVE-2026-27145 · CVE-2026-42504 · CVE-2026-42507

RHSA-2026:57194: Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.5 security update

CVE-2024-45336 · CVE-2025-22866 · CVE-2026-13676 · CVE-2026-25680 · CVE-2026-25681 · CVE-2026-27136 · CVE-2026-27141 · CVE-2026-27145 · CVE-2026-33811 · CVE-2026-33814 · CVE-2026-39817 · CVE-2026-39819 · CVE-2026-39820 · CVE-2026-39821 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-39827 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39831 · CVE-2026-39832 · CVE-2026-39833 · CVE-2026-39834 · CVE-2026-39835 · CVE-2026-39836 · CVE-2026-42499 · CVE-2026-42502 · CVE-2026-42504 · CVE-2026-42506 · CVE-2026-42507 · CVE-2026-42508 · CVE-2026-44740 · CVE-2026-44990 · CVE-2026-45623 · CVE-2026-46597 · CVE-2026-46598 · CVE-2026-59869 · CVE-2026-66804 · CVE-2026-66805 · CVE-2026-66808 · CVE-2026-69153 · CVE-2026-73086

msrc_CVE-2026-42507: Arbitrary inputs are included in errors without any escaping in net/textproto

CVE-2026-42507

RHSA-2026:50205: Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.10.1 release

CVE-2025-5278 · CVE-2026-5435 · CVE-2026-5450 · CVE-2026-5928 · CVE-2026-27145 · CVE-2026-33811 · CVE-2026-33814 · CVE-2026-39820 · CVE-2026-39823 · CVE-2026-42504 · CVE-2026-42507 · CVE-2026-54369 · CVE-2026-54370

SUSE-SU-2026:22638-1: Security update for go1.25-openssl

SUSE-SU-2026:2327-1: Security update for go1.26

CVE-2026-27145 · CVE-2026-42504 · CVE-2026-42507

openSUSE-SU-2026:10959-1: go1.25-1.25.11-1.1 on GA media

CVE-2026-27145 · CVE-2026-42504 · CVE-2026-42507

RHSA-2026:49702: Red Hat Security Advisory: golang security update

SUSE-SU-2026:22155-1: Security update for go1.25

CVE-2026-27145 · CVE-2026-42504 · CVE-2026-42507

Source published: Jun 2, 2026, 10:01:37 PM (timezone not stated)
Source modified: Jun 3, 2026, 7:04:45 PM (timezone not stated)
Observed here: 11 Nov 2026 11:05:59 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

nvd · CVE-2026-42507

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Awaiting Analysis

Original publisher date fields

published: 2026-06-02T23:16:38.027

lastModified: 2026-07-22T19:10:00.120

Source published: 2 Jun 2026 23:16:38 UTC
Source modified: 22 Jul 2026 19:10:00 UTC
Observed here: 25 Oct 2026 10:17:15 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

osv · GO-2026-5039

Published

Source published: 2 Jun 2026 21:39:47 UTC
Source modified: 3 Oct 2026 10:41:52 UTC
Observed here: 24 Oct 2026 13:19:41 UTC
Source terms: OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.