Описание
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| golang-1.26 | fixed | 1.26.4-1 | package | |
| golang-1.25 | fixed | 1.25.11-1 | package | |
| golang-1.24 | removed | package | ||
| golang-1.24 | no-dsa | trixie | package | |
| golang-1.19 | removed | package | ||
| golang-1.19 | no-dsa | bookworm | package | |
| golang-1.15 | removed | package | ||
| golang-1.15 | postponed | bullseye | package |
Примечания
https://github.com/golang/go/issues/79217
https://github.com/golang/go/commit/7f24db453a60faf6a3546d60bb02917a0a7aace0 (go1.26.4)
https://github.com/golang/go/commit/b79e0339290e14b3b2de1dc4942b8a88701ddb02 (go1.25.11)
EPSS
Связанные уязвимости
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Quadratic complexity in WordDecoder.DecodeHeader in mime
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
EPSS