Arbitrary inputs are included in errors without any escaping in net/textproto

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-42507 · Microsoft / collected KEV context

EUVD-2026-34040

GHSA-h3gm-q7m7-mp28

GO-2026-5039

BIT-golang-2026-42507

cve-program · CVE-2026-42507

• https://go.dev/issue/79346
• https://go.dev/cl/777060
• https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
• https://pkg.go.dev/vuln/GO-2026-5039

euvd · EUVD-2026-34040

• https://go.dev/issue/79346
• https://go.dev/cl/777060
• https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
• https://pkg.go.dev/vuln/GO-2026-5039

nvd · CVE-2026-42507

• https://go.dev/cl/777060
• https://go.dev/issue/79346
• https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
• https://pkg.go.dev/vuln/GO-2026-5039

osv · GO-2026-5039

• https://go.dev/issue/79346
• https://go.dev/cl/777060
• https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw

• When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged. · Advisory content revised · 1 Nov 2026