Live › vulnerability › CVE-2026-94440
Go to dashboardGo's standard library net/textproto and mime/multipart packages can be made to read an arbitrarily long header line into memory, bypassing the configured memory limit when parsing multipart forms. An attacker who can send a crafted multipart request can exhaust server memory and cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| stdlib | go | >= 1.27.0-0, < 1.27.2 | 1.26.9, 1.27.2 |
go version on build and deploy hosts and check whether it is in the affected range 1.27.0 to before 1.27.2 (or below 1.26.9 on that branch)Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild binaries.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
This page as .md · .json · in your agent: get_signal("CVE-2026-94440")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.