---
id: "CVE-2026-94440"
kind: "vulnerability"
aliases: ["CVE-2026-94440", "GO-2026-6608"]
title: "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart"
severity: "high"
cvss: 7.5
epss: 0.00404
exploited: false
status: "open"
category: "runtime"
products: [{"name": "stdlib", "fixed": ["1.26.9", "1.27.2"], "affected": ">= 1.27.0-0, < 1.27.2", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["file-upload", "go", "golang", "http-servers", "runtime", "self-hosted"]
not_affected_if: ["behind-strict-body-limit-proxy", "go-below-1.27.0", "no-multipart-parsing"]
published_at: "2026-10-08T22:31:09+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:56:07+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6608", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-94440", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94440", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Go's standard library net/textproto and mime/multipart packages can be made to read an arbitrarily long header line into memory, bypassing the configured memory limit when parsing multipart forms. An attacker who can send a crafted multipart request can exhaust server memory and cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:stdlib affected >= 1.27.0-0, < 1.27.2 fixed 1.26.9, 1.27.2

## How to check

Run 'go version' on build and deploy hosts and check whether it is in the affected range 1.27.0 to before 1.27.2 (or below 1.26.9 on that branch).
Find services that parse multipart input with mime/multipart (for example r.ParseMultipartForm or multipart.Reader) and accept untrusted uploads.

## Fix

Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild binaries.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6608
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-94440
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94440

## From the sources

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_