VulnSocial

CVE-2026-42504Patch

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-407

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 4 signals
  • General: 1 classified signal
  • Peaked 3d ago at 1 mentions (2026-06-03); latest day: 1
  • 4 total mentions across 4 days

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-06-03: 1Mentions · 2026-06-06: 1Mentions · 2026-06-10: 1Mentions · 2026-07-20: 1Patch / Workaround · 2026-06-06: 1Patch / Workaround · 2026-06-10: 1Patch / Workaround · 2026-07-20: 1Technical Details · 2026-06-03: 1Technical Details · 2026-06-06: 1Technical Details · 2026-06-10: 1Technical Details · 2026-07-20: 106-0306-0606-1007-20
Signal classification2 categories
Patch
375.0%
General
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-06-031
General1
2026-06-061
Patch1
2026-06-101
Patch1
2026-07-201
Patch1
Full discourse4 posts
  • Open Source Security mailing list@oss_security
    Patch

    Go 1.26.4, 1.25.11 fix 3 CVEs https://www.openwall.com/lists/oss-security/2026/06/03/2 CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping CVE-2026-27145: crypto/x509: split candidate hostname only once

    Post summary

    The post announces that Go 1.26.4 and 1.25.11 provide patches for three CVEs, offering concise technical descriptions of each flaw, with no mention of PoC, exploit tools, or active exploitation.

    01040443
    4.7K followersView on X
  • VulniPulse@vulnipulse
    Patch

    ⚠️ NetApp Trident Protect alert: CVE-2026-42504 (CVSS 7.5) Attackers could disrupt service or cause a denial of service. No workaround; upgrade to a vendor-listed fixed release. https://vulnipulse.com/advisories/netapp-ntap-20260619-0002 #NetApp #TridentProtect #CyberSecurity #CVE

    Post summary

    The message is a patch advisory for CVE-2026-42504, urging users to upgrade to the vendor’s fixed release to mitigate a 7.5‑scored DoS vulnerability.

    0000046
    6 followersView on X
  • ThreatCluster@threatcluster
    Patch

    SUSE released new Go1.25.11 and Go1.26.4 packages fixing CVE-2026-27145, CVE-2026-42504 and CVE-2026-42507 in crypto/x509, mime and net/textproto, rated as moderate severity, according to Linuxsecurity. https://threatcluster.io/cluster/suse-releases-security-updates-for-go125-and-go126-addressin-32626cd0

    Post summary

    SUSE has published updated Go packages that address CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507 affecting crypto/x509, mime, and net/textproto modules, offering patches with a moderate severity rating.

    0000049
    318 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-42504 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. https://www.cve.org/CVERecord?id=CVE-2026-42504

    Post summary

    The CVE refers to a denial‑of‑service issue caused by decoding malicious MIME headers, but no PoC, exploit, patch, or active use is reported.

    00000185
    57.6K followersView on X

Explore more

Back to dashboard