net/textproto puts arbitrary input without escaping as part of its error. As a result, downstream users of the package, such as net/http and net/smtp, might see attacker-controlled text injected into their errors. We expect this to have a relatively limited impact (e.g. something that does not look like an error shows up in a victim's logs due to newlines being injected into the error). Therefore, we are treating this as a PUBLIC track issue, per the Go Security Policy (https://go.dev/security/policy).
This is CVE-2026-42507.
net/textprotoputs arbitrary input without escaping as part of its error. As a result, downstream users of the package, such asnet/httpandnet/smtp, might see attacker-controlled text injected into their errors. We expect this to have a relatively limited impact (e.g. something that does not look like an error shows up in a victim's logs due to newlines being injected into the error). Therefore, we are treating this as a PUBLIC track issue, per the Go Security Policy (https://go.dev/security/policy).This is CVE-2026-42507.