Repository navigation
net/textproto, mime/multipart: memory limit bypass when parsing MIME headers #81741
Description
Parsing a multipart form could bypass memory limits and read an
arbitrarily long line into memory when the remaining limit at the
start of a part was less than 400 bytes.
Multipart form memory limits are now properly enforced in this situation.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-94440 and Go issue https://go.dev/issue/81741.
This was a PRIVATE track issue originally tracked in http://b/547883711.
Activity
thatnealpatel commentedon Sep 30, 2026
@gopherbot Please open backports for this security issue.
gopherbot commentedon Sep 30, 2026
Backport issue(s) opened: #81901 (for 1.26), #81902 (for 1.27).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847026 mentions this issue:
[release-branch.go1.27] net/textproto: enforce MIME memory limit on first linegopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847106 mentions this issue:
[release-branch.go1.26] net/textproto: enforce MIME memory limit on first line[release-branch.go1.27] net/textproto: enforce MIME memory limit on f…
[release-branch.go1.26] net/textproto: enforce MIME memory limit on f…
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847307 mentions this issue:
net/textproto: enforce MIME memory limit on first linenet/textproto: enforce MIME memory limit on first line
[-]security: fix CVE-2026-94440[/-][+]net/textproto, mime/multipart: memory limit bypass when parsing MIME headers[/+]