{"id":"CVE-2026-94440","kind":"vulnerability","aliases":["CVE-2026-94440","GO-2026-6608"],"related":[],"title":"Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.","summary":"Go's standard library net/textproto and mime/multipart packages can be made to read an arbitrarily long header line into memory, bypassing the configured memory limit when parsing multipart forms. An attacker who can send a crafted multipart request can exhaust server memory and cause a denial of service.","severity":"high","cvss":7.5,"epss":0.00404,"exploited":false,"exploited_at":null,"products":[{"name":"stdlib","fixed":["1.26.9","1.27.2"],"affected":">= 1.27.0-0, < 1.27.2","ecosystem":"go"}],"ecosystems":["go"],"tags":["file-upload","go","golang","http-servers","runtime","self-hosted"],"not_affected_if":["behind-strict-body-limit-proxy","go-below-1.27.0","no-multipart-parsing"],"how_to_check":"Run 'go version' on build and deploy hosts and check whether it is in the affected range 1.27.0 to before 1.27.2 (or below 1.26.9 on that branch).\nFind services that parse multipart input with mime/multipart (for example r.ParseMultipartForm or multipart.Reader) and accept untrusted uploads.","fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild binaries.","status":"open","published_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:07+00:00","updated_at":"2026-10-23T19:56:07+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T19:56:07Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild binaries.\nunknown for any non-toolchain mitigation.","summary":"Go's standard library net/textproto and mime/multipart packages can be made to read an arbitrarily long header line into memory, bypassing the configured memory limit when parsing multipart forms. An attacker who can send a crafted multipart request can exhaust server memory and cause a denial of service.","category":"runtime","who_cares":["go","golang","self-hosted","http-servers","file-upload"],"confidence":0.7,"analyst_note":"","how_to_check":"Run 'go version' on build and deploy hosts and check whether it is in the affected range 1.27.0 to before 1.27.2 (or below 1.26.9 on that branch).\nFind services that parse multipart input with mime/multipart (for example r.ParseMultipartForm or multipart.Reader) and accept untrusted uploads.\nunknown for whether a specific deployed binary embeds an affected toolchain.","needs_analyst":false,"not_affected_if":["go-below-1.27.0","no-multipart-parsing","behind-strict-body-limit-proxy"],"severity_if_unknown":"high"},"cost_usd":0.000422,"input_tokens":2083,"output_tokens":427,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A,18A '-6608':16A '-94440':13A,19A '400':110C 'arbitrarili':47B,92C 'attack':63B 'bypass':3A,53B,86C 'byte':111C 'caus':76B 'configur':55B 'craft':68B 'cve':11A,17A 'denial':78B 'exhaust':72B 'file':22B 'file-upload':21B 'form':61B,84C 'go':14A,24B,33B 'golang':25B 'header':7A,49B 'host':32B 'http':27B 'http-server':26B 'less':108C 'librari':36B 'limit':2A,57B,88C,100C 'line':50B,94C 'long':48B,93C 'made':43B 'memori':1A,52B,56B,74B,87C,96C 'mime':6A 'mime/multipart':10A,39B 'multipart':60B,69B,83C 'net/textproto':9A,37B 'packag':40B 'pars':5A,59B,81C 'part':106C 'read':45B,90C 'remain':99C 'request':70B 'runtim':29B 'self':31B 'self-host':30B 'send':66B 'server':28B,73B 'servic':80B 'standard':35B 'start':103C 'stdlib':20A 'upload':23B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T22:31:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6608","url":"https://pkg.go.dev/vuln/GO-2026-6608","severity":null,"published_at":"2026-10-08T22:31:09+00:00","modified_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-94440","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94440","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-94440","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94440","severity":null,"published_at":"2026-10-08T23:17:04+00:00","modified_at":"2026-10-09T17:16:50+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}