VulnSocial

CVE-2026-42507Patch

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 4 signals
  • Disclosure: 1 classified signal
  • Peaked 3d ago at 1 mentions (2026-06-03); latest day: 1
  • 4 total mentions across 4 days

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-06-03: 1Mentions · 2026-06-06: 1Mentions · 2026-06-07: 1Mentions · 2026-06-10: 1Patch / Workaround · 2026-06-06: 1Patch / Workaround · 2026-06-07: 1Patch / Workaround · 2026-06-10: 1Technical Details · 2026-06-03: 1Technical Details · 2026-06-06: 1Technical Details · 2026-06-07: 1Technical Details · 2026-06-10: 106-0306-0606-0706-10
Signal classification2 categories
Patch
375.0%
Disclosure
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-06-031
Disclosure1
2026-06-061
Patch1
2026-06-071
Patch1
2026-06-101
Patch1
Full discourse4 posts
  • Open Source Security mailing list@oss_security
    Patch

    Go 1.26.4, 1.25.11 fix 3 CVEs https://www.openwall.com/lists/oss-security/2026/06/03/2 CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping CVE-2026-27145: crypto/x509: split candidate hostname only once

    Post summary

    The notice announces that Go 1.26.4 and 1.25.11 include patches for three CVEs, providing brief technical details for each vulnerability.

    01040443
    4.7K followersView on X
  • ThreatCluster@threatcluster
    Patch

    SUSE released new Go1.25.11 and Go1.26.4 packages fixing CVE-2026-27145, CVE-2026-42504 and CVE-2026-42507 in crypto/x509, mime and net/textproto, rated as moderate severity, according to Linuxsecurity. https://threatcluster.io/cluster/suse-releases-security-updates-for-go125-and-go126-addressin-32626cd0

    Post summary

    SUSE has issued updated Go 1.25.11 and 1.26.4 packages resolving three moderate‑severity CVEs in crypto/x509, mime, and net/textproto; no exploitation or PoC information is provided.

    0000049
    318 followersView on X
  • WindowsForum@windowsforum
    Patch

    🪟 “Not RCE” doesn’t mean “meh.” CVE-2026-42507 is basically log poisoning with a Go stdlib bow—attackers get to rewrite how your systems tell stories. Patch anyway. https://windowsforum.com/threads/cve-2026-42507-go-net-textproto-log-injection-windows-patch-priority-guide.423494/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsAdministration #LogInjection #GoSecurity #Cve202642507 https://t.co/Y1IBj5AJaG

    Post summary

    The tweet highlights CVE‑2026‑42507 as a log poisoning flaw in Go’s stdlib and urges users to apply a patch, without mentioning a PoC, exploit code, or active exploitation.

    0000022
    1.2K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-42507 When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content … https://www.cve.org/CVERecord?id=CVE-2026-42507

    Post summary

    Provides a brief technical description of CVE-2026-42507, noting how Go’s net/textproto error handling could allow malicious input to be reflected in error messages, and links to the CVE record.

    00000200
    57.6K followersView on X

Explore more

Back to dashboard