CVE-2026-42507: Go net/textproto Error Message Injection Vulnerability

Technical summary

The net/textproto package in Go contains an input validation gap in its error-handling routines. When functions in this package encounter errors during text protocol parsing, they construct error messages that include the original input data without proper sanitization. An attacker can supply specially crafted input that, upon triggering an error condition, becomes part of the returned error object. Since error messages are commonly serialized, logged, or presented in user interfaces, the unsanitized input is propagated downstream. The CVSS 3.1 score of 5.3 reflects the network-accessible nature and low complexity of exploitation, though the impact is limited to integrity (log injection/message manipulation) with no confidentiality or availability impact.

Business impact

Organizations relying on Go applications that use net/textproto are at risk of log poisoning and alert injection attacks. Security teams may receive false or manipulated alerts that appear to originate from their own systems, eroding trust in monitoring and SIEM outputs. Incident responders could be misled by injected error content, potentially diverting attention from genuine security events. In compliance-sensitive environments, tampered logs complicate audit trails and forensic investigation. The attack requires network access but no authentication or user interaction, making it a concern for internet-facing services.

Affected systems

This vulnerability affects Go applications that parse network text protocols and rely on the net/textproto package. The vulnerability is in the Go standard library itself; however, the provided source data does not list specific vendor products or versions. Organizations should consult the official Go security advisory to determine which versions of Go are affected and which applications in their environment import this package. Common use cases include mail servers, HTTP client/server code, and custom protocol handlers.

Exploitability

Exploitation is straightforward from a network perspective: an attacker sends malformed or specially crafted input to a Go application using net/textproto. When the input triggers an error condition, the attacker's content is reflected in the error message. No special privileges, authentication, or user interaction is required. The barrier to exploitation is low because the attack surface includes any network-accessible Go service that parses text protocols and logs or displays errors. However, the attacker must have prior knowledge of where errors are logged or displayed to gain useful benefit from the injection.

Remediation

Update Go to a patched version released by the Go project. Verify against the official Go security advisory for the specific affected versions and their corresponding fixes. In the interim, organizations can implement defense-in-depth controls: sanitize error messages before logging them, use structured logging that separates input data from system metadata, and implement input validation upstream of error-prone functions. Restrict network access to affected services where feasible.

Patch guidance

Check the official Go project security advisories and release notes for CVE-2026-42507 to identify the patched Go versions. Update your Go toolchain and recompile any applications that depend on net/textproto. Coordinate testing in a non-production environment first to ensure compatibility. Prioritize systems that expose parsing services to untrusted networks.

Detection guidance

Monitor logs and error streams from Go applications for unexpected or suspicious content that appears in error messages. Implement anomaly detection on error message patterns to catch injected content. Use centralized logging with integrity checking to detect log tampering. Network-level detection is difficult because the exploit uses valid protocol syntax; focus on log analysis and application-level monitoring for malformed input that generates errors.

Why prioritize this

While the CVSS score is moderate (5.3), the ease of exploitation and the potential for undermining logging and alerting infrastructure warrant prompt attention. Organizations with strict log integrity or compliance requirements should prioritize this higher. Conversely, environments with robust log sanitization, structured logging, and alert validation may deprioritize slightly. Internet-facing Go services using net/textproto should be updated as soon as patches are available.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects: (1) Network accessibility (AV:N) — no special access required; (2) Low attack complexity (AC:L) — straightforward to craft malicious input; (3) No privileges or user interaction required (PR:N/UI:N); (4) Scope unchanged (S:U); (5) No confidentiality impact (C:N); (6) Low integrity impact (I:L) — logs and messages are manipulated, not core data; (7) No availability impact (A:N). The score correctly categorizes this as a moderate log-injection risk rather than a critical flaw.

Frequently asked questions