CVE-2026-42507
Textproto Package Error Message Injection Vulnerability
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: Go Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the net/textproto package where functions return errors that include the input data as part of the error message.
Because the input is included in the error, an attacker might be able to inject misleading or malicious content into these error messages that are printed or logged.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to inject misleading content into error messages that are printed or logged.
This could cause confusion or misinterpretation of logs or error outputs, potentially hiding real issues or causing incorrect responses based on the misleading information.