CVE-2026-94440: go standard library mime/multipart

CVSS: 7.5v3.1HighAwaiting analysis

AliasesUBUNTU-CVE-2026-94440DEBIAN-CVE-2026-94440CGA-222p-4jmc-7wmf+8829 more

Published 08-10-2026Last modified 09-10-2026

Vulnerability summary

CVE-2026-94440 is a high (CVSS 7.5) vulnerability in go standard library mime/multipart. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.4% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.40%

0%100%

Low · Change unavailable

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 10

MGASA-2026-0497 OPENSUSE-SU-2026:12093-1 OPENSUSE-SU-2026:12101-1 OPENSUSE-SU-2026:12112-1 OPENSUSE-SU-2026:22093-1 OPENSUSE-SU-2026:22095-1+5 more

Timeline

08-10-2026
PublishedVulnerability first disclosed.
09-10-2026
Last modifiedVulnerability information updated.

Description

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

CVSS metrics

4 scores · 4 sources · 1 version

v3.17.5

EPSS trend

Probability

0.40%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

Change unavailable

09-10-202621-10-2026

EPSS score

0.40%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Chainguard200 products

aactl< 0.4.12-r79
access-log-exporter-fips< 0.4.22-r1
acm-controller-fips< 1.10.0-r1
actions-runner-controller< 0.15.0-r1
actions-runner-controller-fips< 0.15.0-r1

addon-resizer< 1.8.24-r7
addon-resizer-fips< 1.8.24-r7
ageAll versions (No fix recorded)
age-fipsAll versions (No fix recorded)
agentbeat-fips< 9.2.7-r30
agentbeat-fips-8.19< 8.19.23-r1
alloydb-auth-proxy-fips< 1.17.0-r2
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-downloader-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-config-translator-fipsAll versions (No fix recorded)
amazon-cloudwatch-agent-fips< 1.300074.0-r2
amazon-cloudwatch-agent-operator-fips< 3.7.0-r8
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fipsAll versions (No fix recorded)
amazon-ecs-agent-fips< 1.108.0-r1
amazon-ecs-cni-plugins-fips< 2024.9.0_git20260617-r8 | All versions (No fix recorded)
amazon-eks-ami-fips< 20261003-r1
amazon-k8s-cni-fips< 1.23.2-r1 | All versions (No fix recorded)
amazon-k8s-cni-init-fips< 1.23.2-r1
amazon-k8s-cni-init-fips-compat< 1.23.2-r2 | All versions (No fix recorded)
amazon-ssm-agent-ecs-exec-fips< 3.3.5512.0-r1
amazon-ssm-agent-fips< 3.3.5512.0-r1 | All versions (No fix recorded)
amazon-vpc-cni-pluginsAll versions (No fix recorded)
amazon-vpc-cni-plugins-fipsAll versions (No fix recorded)
ansible-operator-fips< 1.42.3-r17
apache-beam-java-11-sdk< 2.77.0-r1
apache-beam-java-17-sdk< 2.77.0-r1 | All versions (No fix recorded)
apache-beam-java-21-sdk< 2.77.0-r1 | < 2.77.0-r2
apache-beam-python-3.11-sdk< 2.77.0-r0
apache-beam-python-3.14-sdkAll versions (No fix recorded) | < 2.77.0-r1
apache-exporter< 1.1.1-r7
api-linter< 2.4.0-r1
apiserver-network-proxy-fips-0.34All versions (No fix recorded) | < 0.34.0-r15
apiserver-network-proxy-fips-0.34-agent< 0.34.0-r15
apiserver-network-proxy-fips-0.35< 0.35.0-r15
apiserver-network-proxy-fips-0.35-agent< 0.35.0-r15
apiserver-network-proxy-fips-0.36< 0.36.0-r15
apiserver-network-proxy-fips-0.36-agentAll versions (No fix recorded) | < 0.36.0-r15
apiserver-network-proxy-fips-0.37< 0.37.0-r3 | All versions (No fix recorded)
apiserver-network-proxy-fips-0.37-agent< 0.37.0-r3
apko-fips< 1.4.10-r1
apm-server-fips-8.19< 8.19.23-r2
apm-server-fips-9.2< 9.2.8-r17
apm-server-fips-9.3< 9.3.8-r9
apm-server-fips-9.4< 9.4.8-r2 | < 9.4.8-r3
apm-server-fips-9.5< 9.5.5-r2
application-gateway-kubernetes-ingress-fips< 1.9.14-r1
argo-cd-3.3< 3.3.15-r1
argo-cd-3.3-compat< 3.3.15-r1
argo-cd-3.4< 3.4.10-r1
argo-cd-3.4-compat< 3.4.10-r1
argo-cd-fips-3.1< 3.1.16-r16
argo-cd-fips-3.1-compat< 3.1.16-r16
argo-cd-fips-3.2< 3.2.12-r27
argo-cd-fips-3.2-compat< 3.2.12-r27
argo-cd-fips-3.3< 3.3.15-r1
argo-cd-fips-3.3-compat< 3.3.15-r1
argo-cd-fips-3.4< 3.4.10-r1
argo-cd-fips-3.4-compat< 3.4.10-r1
argo-cd-fips-3.5< 3.5.4-r1
argo-cd-fips-3.5-compat< 3.5.4-r1
argo-events-fips< 1.9.11-r15
argo-rollouts-fips< 1.10.0-r4
argo-workflow-controller-3.7< 3.7.18-r10
argo-workflow-controller-4.0< 4.0.12-r2
argo-workflow-controller-4.1< 4.1.4-r2
argo-workflow-controller-fips-3.7< 3.7.18-r10
argo-workflow-controller-fips-4.0< 4.0.13-r1
argo-workflow-controller-fips-4.1< 4.1.4-r1 | < 4.1.5-r0
argo-workflow-executor-3.7< 3.7.18-r10
argo-workflow-executor-4.1< 4.1.5-r0
argo-workflow-executor-fips-3.7< 3.7.18-r10
argo-workflow-executor-fips-4.0< 4.0.13-r1
argo-workflow-executor-fips-4.1< 4.1.5-r0
argo-workflows-3.7< 3.7.18-r10
argo-workflows-4.0< 4.0.12-r2
argo-workflows-4.1< 4.1.4-r2
argo-workflows-fips-3.7< 3.7.18-r10 | All versions (No fix recorded)
argo-workflows-fips-4.0< 4.0.13-r1
argo-workflows-fips-4.1All versions (No fix recorded) | < 4.1.4-r1
argocd-image-updater-fips< 1.3.1-r1
athenz-cert-manager-issuer-fips< 0.0.9-r4
athenz-csi-driver-fips< 0.0.16-r9
athenz-csi-driver-fips-approver< 0.0.16-r9
atlantis< 0.48.1-r1
atlantis-fips< 0.48.1-r2
atlas< 1.3.0-r9
atlas-fips< 1.3.0-r11
auditbeat-9.3< 9.3.8-r17
auditbeat-fips-8.19< 8.19.23-r1
auditbeat-fips-9.2< 9.2.8-r25
auditbeat-fips-9.3All versions (No fix recorded) | < 9.3.8-r12
auditbeat-fips-9.4< 9.4.8-r1
auditbeat-fips-9.5< 9.5.5-r2
authentik-2026.5-go-server< 2026.5.7-r10
authentik-fips-2025.12-go-server< 2025.12.6-r19
authentik-fips-2026.2-go-server< 2026.2.7-r6
authentik-fips-2026.5-go-server< 2026.5.7-r12
authservice< 1.1.8-r6
authservice-fips< 1.1.8-r7
avmfixAll versions (No fix recorded)
avmfix-fipsAll versions (No fix recorded)
aws-application-networking-k8s< 2.1.3-r5
aws-application-networking-k8s-fips< 2.1.3-r3
aws-ebs-csi-driver-1.58< 1.58.0-r15
aws-ebs-csi-driver-1.60< 1.60.1-r14
aws-ebs-csi-driver-1.61< 1.61.1-r10
aws-ebs-csi-driver-1.62< 1.62.0-r9
aws-ebs-csi-driver-1.63< 1.63.1-r8
aws-ebs-csi-driver-1.64< 1.64.0-r6
aws-ebs-csi-driver-fips-1.57< 1.57.1-r20 | < 1.57.1-r21
aws-ebs-csi-driver-fips-1.58< 1.58.0-r16
aws-ebs-csi-driver-fips-1.59< 1.59.0-r17
aws-ebs-csi-driver-fips-1.60< 1.60.1-r16
aws-ebs-csi-driver-fips-1.61< 1.61.1-r12
aws-ebs-csi-driver-fips-1.62< 1.62.0-r13
aws-ebs-csi-driver-fips-1.63< 1.63.1-r7
aws-ebs-csi-driver-fips-1.64< 1.64.0-r6
aws-ebs-csi-driver-fips-1.65< 1.65.0-r4
aws-ebs-csi-driver-fips-1.66< 1.66.1-r1
aws-efs-csi-driver-fips< 3.5.1-r3
aws-eks-pod-identity-agent-fips< 0.2.5-r1
aws-flb-cloudwatch< 1.9.5-r10
aws-flb-cloudwatch-fips< 1.9.5-r10
aws-flb-firehose< 1.7.3-r13
aws-flb-firehose-fips< 1.7.3-r11
aws-flb-kinesis-fips< 1.10.4-r8 | < 1.10.4-r9
aws-for-fluent-bit-init-fips< 3.5.0-r1
aws-fsx-csi-driver-fips< 1.11.0-r1
aws-iam-authenticator-fips< 0.7.20-r5
aws-lambda-runtime-interface-emulator-fips< 1.37-r3
aws-load-balancer-controller-fips< 3.6.0-r1
aws-network-policy-agentAll versions (No fix recorded) | < 1.4.3-r1
aws-network-policy-agent-fips< 1.4.3-r1 | All versions (No fix recorded)
aws-node-termination-handler< 1.25.6-r21
aws-node-termination-handler-fips< 1.25.6-r21
aws-nuke< 3.68.3-r1
aws-nuke-fips< 3.68.3-r1
aws-otel-collector< 0.50.0-r6
aws-otel-collector-fips< 0.50.0-r7
aws-otel-collector-healthcheck< 0.50.0-r6
aws-otel-collector-healthcheck-fips< 0.50.0-r7
aws-privateca-issuer-fips< 1.10.0-r1
aws-signer-notation-plugin-fips< 1.0.2292-r24 | < 1.0.2292-r23
aws-sigv4-proxy-fips< 1.13.1-r0
azcopy-fipsAll versions (No fix recorded) | < 10.32.8-r4
azure-metrics-exporter< 25.12.0-r7
azure-metrics-exporter-fips< 25.12.0-r3
azure-service-operator< 2.21.1-r2
azure-service-operator-fips< 2.21.1-r2
azure-vnet-cni< 1.9.2-r2
azuredisk-csi-1.34< 1.34.7-r1
azuredisk-csi-1.35< 1.35.0-r1
azuredisk-csi-fips-1.33< 1.33.13-r1
azuredisk-csi-fips-1.34< 1.34.7-r1
azuredisk-csi-fips-1.35< 1.35.0-r1
azuredisk-csi-fips-1.36< 1.36.0-r1
azurefile-csi-1.33< 1.33.10-r12
azurefile-csi-fips-1.33< 1.33.10-r14
azurefile-csi-fips-1.34< 1.34.10-r1
azurefile-csi-fips-1.35< 1.35.10-r1
backup-restore-operator-10.0< 10.0.10-r1
backup-restore-operator-8.1< 8.1.9-r2
backup-restore-operator-fips-10.0< 10.0.10-r1 | All versions (No fix recorded)
backup-restore-operator-fips-11.0< 11.0.3-r1
backup-restore-operator-fips-7.0< 7.0.11-r1
backup-restore-operator-fips-8.1< 8.1.9-r1
backup-restore-operator-fips-9.0< 9.0.8-r1
bank-vaults< 1.33.2-r5
bank-vaults-fips< 1.33.2-r6
bank-vaults-template< 1.33.2-r5
bank-vaults-template-fips< 1.33.2-r6
bank-vaults-vault-operator-fips< 1.24.1-r1
bento-fips< 1.22.0-r1
blob-csi-1.23< 1.23.11-r86
blob-csi-1.24< 1.24.11-r35
blob-csi-1.25< 1.25.10-r33
blob-csi-1.26< 1.26.17-r3 | < 1.26.17-r2
blob-csi-1.27< 1.27.11-r1
blob-csi-fips-1.23< 1.23.11-r90
blob-csi-fips-1.24< 1.24.11-r37
blob-csi-fips-1.25< 1.25.10-r31
blob-csi-fips-1.26< 1.26.17-r3
blob-csi-fips-1.27< 1.27.11-r1
blobfuse2-fips< 2.4.2-r24
blobfuse2-fips-health-monitorAll versions (No fix recorded)
bom< 0.8.0-r2
boring-registry-fips< 0.19.0-r9
boringssl-fips-static-20240407-toolsAll versions (No fix recorded)
buildah-fips< 1.45.1-r3
buildctl-fips< 0.34.0-r1
buildkitd-fips< 0.34.0-r1
buildkite-agent-3< 3.138.0-r1
buildkite-agent-fips-3< 3.138.0-r1
buildkite-agent-fips-4< 4.3.0-r1
buildtools-buildifier-fipsAll versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 4066. Use Open JSON for the complete list.

References

10 links

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities