CVE-2026-42507: Arbitrary inputs are included in errors without any escaping in net/textproto

Awaiting analysis

AliasesUBUNTU-CVE-2026-42507DEBIAN-CVE-2026-42507CGA-2383-c2gx-7qc9+5135 more

Published 02-06-2026Last modified 03-06-2026

Vulnerability summary

CVE-2026-42507 is a medium (CVSS 5.3) vulnerability in go standard library net/textproto. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 31% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.37%

0%100%

Low · -0.04 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

02-06-2026
PublishedVulnerability first disclosed.
03-06-2026
Last modifiedVulnerability information updated.

Description

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

CVSS metrics

5 scores · 5 sources · 1 version

v3.15.3

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

Decrease -0.04 pp

From 0.41% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

aactl< 0.4.12-r54
act< 0.2.89-r1
actionlintAll versions (No fix recorded)
actions-runner-controller< 0.14.2-r2
addon-resizer< 1.8.23-r20

addon-resizer-fips< 1.8.23-r19
age-fips< 1.3.1-r12 | All versions (No fix recorded)
agentbeat< 9.2.7-r12
agentbeat-fips< 9.2.7-r11
amazon-cloudwatch-agent< 1.300069.0-r2
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizardAll versions (No fix recorded)
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-downloaderAll versions (No fix recorded)
amazon-cloudwatch-agent-config-downloader-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-translatorAll versions (No fix recorded)
amazon-cloudwatch-agent-config-translator-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-fips< 1.300069.0-r2
amazon-cloudwatch-agent-operator< 3.5.0-r0
amazon-cloudwatch-agent-start-amazon-cloudwatch-agentAll versions (No fix recorded)
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fipsAll versions (No fix recorded)
amazon-ecs-agent< 1.103.2-r1
amazon-ecs-cni-plugins-fips< 2024.9.0_git20260522-r1
amazon-eks-ami< 20260527-r1
amazon-k8s-cni< 1.22.1-r1
amazon-k8s-cni-init< 1.22.1-r1
amazon-k8s-cni-init-fips-compat< 1.22.1-r2 | All versions (No fix recorded)
amazon-vpc-cni-plugins-fips< 1.3_git20260307-r3
ansible-operator< 1.42.2-r9
apache-exporter< 1.0.12-r7
apisix-ingress-controller< 2.1.0-r1
apm-server-8.19< 8.19.16-r1
apm-server-9.2< 9.2.8-r6
apm-server-9.3< 9.3.5-r2
argo-cd-3.0< 3.0.23-r6
argo-cd-3.0-compat< 3.0.23-r6
argo-cd-3.1< 3.1.16-r3
argo-cd-3.1-compat< 3.1.16-r3
argo-cd-3.3-compatAll versions (No fix recorded)
argo-cd-fips-3.0< 3.0.23-r7
argo-cd-fips-3.0-compat< 3.0.23-r7
argo-cd-fips-3.1< 3.1.16-r1
argo-cd-fips-3.1-compat< 3.1.16-r1
argo-cd-fips-3.2< 3.2.12-r6
argo-cd-fips-3.2-compat< 3.2.12-r6
argo-cd-fips-3.3< 3.3.11-r1
argo-cd-fips-3.3-compat< 3.3.11-r1
argo-cd-fips-3.4< 3.4.3-r1
argo-cd-fips-3.4-compat< 3.4.3-r1
argo-events< 1.9.10-r25
argo-events-fips< 1.9.10-r17
argo-rollouts< 1.9.0-r15
argo-workflow-controller-3.6< 3.6.19-r7
argo-workflow-controller-fips-3.6< 3.6.19-r10
argo-workflow-controller-fips-4.0< 4.0.5-r6
argo-workflow-executor-3.6< 3.6.19-r7
argo-workflow-executor-fips-3.6< 3.6.19-r10
argo-workflow-executor-fips-3.7< 3.7.14-r5
argo-workflow-executor-fips-4.0< 4.0.5-r6
argo-workflows-3.6< 3.6.19-r7
argo-workflows-fips-3.6< 3.6.19-r10
argo-workflows-fips-4.0< 4.0.5-r6
argocd-image-updater< 1.2.1-r2
atlantis< 0.43.0-r5
atlantis-fips< 0.43.0-r7
atlas-1.0< 1.0.0-r9
atlas-1.2< 1.2.2-r0
auditbeat-9.0< 9.0.8-r22
auditbeat-9.3< 9.3.5-r1
auditbeat-fips-8.19< 8.19.16-r1
auditbeat-fips-9.0< 9.0.8-r25
auditbeat-fips-9.3< 9.3.5-r1
auditbeat-fips-9.4< 9.4.2-r1
authentik-fips-2025.12-go-server< 2025.12.6-r2
authentik-fips-2026.2-go-server< 2026.2.4-r2
authservice< 1.1.5-r10
authservice-fips< 1.1.5-r11
avmfixAll versions (No fix recorded)
avmfix-fipsAll versions (No fix recorded)
aws-ebs-csi-driver-1.52< 1.52.1-r14
aws-ebs-csi-driver-1.53< 1.53.0-r12
aws-ebs-csi-driver-1.55< 1.55.0-r10
aws-ebs-csi-driver-1.60< 1.60.1-r3
aws-ebs-csi-driver-fips-1.51< 1.51.2-r14
aws-ebs-csi-driver-fips-1.52< 1.52.1-r14
aws-ebs-csi-driver-fips-1.54< 1.54.0-r12
aws-ebs-csi-driver-fips-1.57< 1.57.1-r5
aws-efs-csi-driver< 3.2.0-r2
aws-efs-csi-driver-fips< 3.2.0-r2
aws-flb-cloudwatch< 1.9.5-r3
aws-flb-cloudwatch-fips< 1.9.5-r1
aws-flb-firehose-fips< 1.7.3-r2
aws-flb-kinesis< 1.10.4-r3
aws-flb-kinesis-fips< 1.10.4-r1
aws-fsx-csi-driver< 1.9.0-r5
aws-fsx-csi-driver-fips< 1.9.0-r5
aws-iam-authenticator-fips< 0.7.17-r1
aws-lambda-runtime-interface-emulator< 1.35-r1
aws-lambda-runtime-interface-emulator-fips< 1.35-r2
aws-network-policy-agent< 1.3.5-r2 | All versions (No fix recorded)
aws-node-termination-handler< 1.25.6-r10
aws-nuke< 3.65.0-r1
aws-otel-collector-fips< 0.48.0-r2
aws-otel-collector-healthcheck-fips< 0.48.0-r2
aws-signer-notation-plugin-fips< 1.0.2292-r14
aws-sigv4-proxy-fips< 1.11.1-r8
azcopy< 10.32.4-r3
azure-service-operator-fips< 2.19.0-r3
azure-workload-identity-webhook< 1.5.1-r21
azuredisk-csi-1.32< 1.32.12-r11
azuredisk-csi-fips-1.32< 1.32.12-r12
azuredisk-csi-fips-1.33< 1.33.10-r2
azuredisk-csi-fips-1.34< 1.34.4-r2
azurefile-csi-fips-1.34< 1.34.6-r2
backup-restore-operator-9.0< 9.0.3-r3
backup-restore-operator-fips-10.0< 10.0.4-r2
backup-restore-operator-fips-7.0< 7.0.6-r4
backup-restore-operator-fips-8.1< 8.1.4-r4
backup-restore-operator-fips-9.0< 9.0.3-r3
bank-vaults< 1.33.1-r2
bank-vaults-fips< 1.33.1-r1
bank-vaults-template< 1.33.1-r2
bank-vaults-template-fips< 1.33.1-r1
bento< 1.18.0-r2
blob-csi-1.26< 1.26.12-r2
blob-csi-fips-1.23< 1.23.11-r76
blob-csi-fips-1.24< 1.24.11-r23
blobfuse2-fips< 2.4.2-r14
blobfuse2-fips-health-monitorAll versions (No fix recorded)
boring-registry-fips< 0.17.0-r6
boringssl-fips-static-20240407-toolsAll versions (No fix recorded)
buildah< 1.44.0-r1
buildah-fips< 1.44.0-r1
buildctl-fips< 0.30.0-r4
buildkitd-fips< 0.30.0-r4
buildtools-buildifier-fipsAll versions (No fix recorded)
buildtools-buildozer-fipsAll versions (No fix recorded)
cadence-cassandra-tool< 1.4.0-r9
cadence-server< 1.4.0-r9
cadence-sql-tool< 1.4.0-r9
cadvisor-fips< 0.57.0-r2
calico-goldmane-3.31All versions (No fix recorded) | < 3.31.7-r3
calico-key-cert-provisioner-3.31< 3.31.7-r3
cargobumpAll versions (No fix recorded)
cass-operator< 1.31.0-r1
cass-operator-fips-no-pvc-delete< 1.31.0-r1
ceph-csi-operator< 1.0.1-r1
cephcsi< 3.17.0-r1
cephcsi-fips< 3.17.0-r1
cerbos-fips< 0.53.0-r4
cerbosctl-fips< 0.53.0-r4
cert-exporter< 2.18.0-r10
cert-manager-1.18< 1.18.6-r5
cert-manager-1.19< 1.19.5-r6
cert-manager-1.20< 1.20.2-r8
cert-manager-acmesolver-1.18< 1.18.6-r5
cert-manager-acmesolver-1.19< 1.19.5-r6
cert-manager-acmesolver-fips-1.18< 1.18.6-r2
cert-manager-acmesolver-fips-1.19< 1.19.5-r6
cert-manager-acmesolver-fips-1.20< 1.20.2-r5
cert-manager-cainjector-1.18< 1.18.6-r5
cert-manager-cainjector-1.19< 1.19.5-r6
cert-manager-cainjector-1.20< 1.20.2-r8
cert-manager-cainjector-fips-1.18< 1.18.6-r2
cert-manager-cainjector-fips-1.19< 1.19.5-r6
cert-manager-cainjector-fips-1.20< 1.20.2-r5
cert-manager-controller-1.18< 1.18.6-r5
cert-manager-controller-1.19< 1.19.5-r6
cert-manager-controller-1.20< 1.20.2-r8
cert-manager-controller-fips-1.18< 1.18.6-r2
cert-manager-controller-fips-1.19< 1.19.5-r6
cert-manager-controller-fips-1.20< 1.20.2-r5
cert-manager-fips-1.18< 1.18.6-r2
cert-manager-fips-1.19< 1.19.5-r6
cert-manager-fips-1.20< 1.20.2-r5
cert-manager-google-cas-issuer< 0.11.0-r15
cert-manager-istio-csr-fips< 0.16.0-r12
cert-manager-openshift-routes< 0.9.0-r7
cert-manager-openshift-routes-fips< 0.9.0-r7
cert-manager-startupapicheck-1.18< 1.18.6-r5
cert-manager-startupapicheck-1.19< 1.19.5-r6
cert-manager-startupapicheck-1.20< 1.20.2-r8
cert-manager-startupapicheck-fips-1.18< 1.18.6-r2
cert-manager-startupapicheck-fips-1.19< 1.19.5-r6
cert-manager-startupapicheck-fips-1.20< 1.20.2-r5
cert-manager-webhook-1.18< 1.18.6-r5
cert-manager-webhook-1.19< 1.19.5-r6
cert-manager-webhook-fips-1.18< 1.18.6-r2
cert-manager-webhook-fips-1.19< 1.19.5-r6
cert-manager-webhook-fips-1.20< 1.20.2-r5
cert-manager-webhook-pdns< 2.5.5-r11
certificate-transparency-fips-trillian-ctserver< 1.3.3-r11
cgo-pkgbuildAll versions (No fix recorded)
chainguard-partners-demoAll versions (No fix recorded)
chainloop-cli< 1.99.0-r1
chainloop-control-plane< 1.99.0-r1
chaos-mesh< 2.8.3-r0
chaos-mesh-daemon< 2.8.3-r0 | All versions (No fix recorded)
chaos-mesh-dashboard< 2.8.3-r0
chaos-mesh-fips< 2.8.2-r11

Show all 199

Alpine1 product

go< 1.26.8-r0

2 vendors · 200 products · Showing 200 of 2740

References

12 links

Show all 12 references

nvd.nist.gov/vuln/detail/CVE-2026-42507OvalAdvisory
security.alpinelinux.org/vuln/CVE-2026-42507Advisory