CVE-2026-42504: Quadratic complexity in WordDecoder.DecodeHeader in mime

Synopsis

This is a denial-of-service vulnerability caused by quadratic CPU complexity in the Go standard library's mime package, specifically in the WordDecoder.DecodeHeader function. The flaw is reachable over the network with no authentication required, and it is triggered by supplying a MIME header containing many invalid encoded-words. Successful exploitation causes the affected service to consume excessive CPU, stalling or crashing it. Patched-image rebuilds at Go 1.25.11 and 1.26.4 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is exposed over the network; an attacker must be able to send a crafted HTTP or other protocol request containing MIME headers to the target service.

• AuthenticationNot required

  No credentials or session token are needed; any unauthenticated request carrying a malformed MIME header is sufficient to trigger the vulnerability.

• Victim interactionNot required

  The attacker does not need a victim to take any action; sending the malicious request directly to the service is enough.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, memory layout dependency, or special environmental state is required to trigger the quadratic CPU consumption.

Blast Radius

• The targeted service consumes excessive CPU processing the malformed MIME header, causing severe throughput degradation or a full service hang.
• Other workloads sharing the same host or container resources experience starvation as CPU is monopolized by the runaway decode loop.
• Availability of any application built on Go's standard mime package is disrupted for the duration of the attack, with no data disclosure or data modification occurring.