CVE-2026-94440
published 2026-10-08CVE-2026-94440: Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.51%
43.3th percentile
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | — | — |
| buildah_project | buildah | — | — |
| container-tools_rhel8 | buildah | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | crun | — | — |
| container-tools_rhel8 | oci-seccomp-bpf-hook | — | — |
| container-tools_rhel8 | podman | — | — |
| container-tools_rhel8 | runc | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
| git-lfs | git-lfs | — | — |
| go-toolset_rhel8 | golang | — | — |
| go_standard_library | mime_multipart | < 1.26.9 | 1.26.9 |
| go_standard_library | mime_multipart | >= 1.27.0-0 < 1.27.2 | 1.27.2 |
| go_standard_library | net_textproto | < 1.26.9 | 1.26.9 |
| go_standard_library | net_textproto | >= 1.27.0-0 < 1.27.2 | 1.27.2 |
| grafana | grafana | — | — |
| helm | helm | — | — |
| inductiveautomation | ignition | — | — |
| kata-containers | kata-containers | — | — |
| kubernetes | cri-o | — | — |
| podman_project | podman | — | — |
| redhat | openshift | — | — |
| satellite_el8 | yggdrasil-worker-forwarder | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
ghsa_unreviewed·2026-10-09
CVE-2026-94440 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
VulDB
Google Go up to 1.26.8/1.27.1 net textproto mime multipart allocation of resources (EUVD-2026-95423)
vuldb·2026-10-09·CVSS 7.5
CVE-2026-94440 [HIGH] Google Go up to 1.26.8/1.27.1 net textproto mime multipart allocation of resources (EUVD-2026-95423)
A vulnerability described as critical has been identified in Google Go up to 1.26.8/1.27.1. Affected is an unknown function of the component net textproto mime multipart. Such manipulation leads to allocation of resources.
This vulnerability is referenced as CVE-2026-94440. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
Ubuntu
Go vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 7.5
CVE-2026-56866 [HIGH] Go vulnerabilities
Title: Go vulnerabilities
Summary: Several security issues were fixed in Go.
It was discovered that Go did not enforce a maximum recursion depth when
parsing deeply nested ASN.1 structures. An attacker could possibly use this
issue to cause Go to crash, resulting in a denial of service.
(CVE-2026-33818)
It was discovered that Go incorrectly reset the depth counter when decoding
XML elements. An attacker could possibly use this issue to cause Go to
crash via deeply nested XML input, resulting in a denial of service.
(CVE-2026-56859)
It was discovered that Go incorrectly handled TLS KeyUpdate messages after
the handshake was completed. A remote attacker could possibly use this
issue to cause Go to use excessive resources, leading to a denial of
service. (CVE-2026-56862)
It was discovere
Red Hat
net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing
vendor_redhat·2026-10-08·CVSS 7.5
CVE-2026-94440 [HIGH] CWE-770 net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing
net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
A flaw was found in the mime/multipart and net/textproto packages in Go. A remote attacker could exploit this vulnerability by submitting a crafted multipart form request that bypasses configured memory limits when the remaining boundary limit is small. This issue allows the application to read an arbitrarily long line into memory, leading to excessive resource consumption and a Denial of Service (DoS).
Package: helm (OpenShift Developer Tools and Services) - Out of support scope
Package: openshift-pipelines
No detection rules found.
No public exploits indexed.
2026-10-08
Published