The vulnerability arises because functions in the net/textproto package return errors that embed the input data directly within the error message. This can allow an attacker to inject misleading or sensitive information into logs or error outputs, potentially confusing administrators or exposing sensitive data. The affected versions include Go standard library versions up to 1.26.0-0. No patch or official remediation guidance is currently available.

The impact is limited to the potential insertion of misleading or sensitive information into error logs or printed error messages. This could lead to confusion during troubleshooting or inadvertent exposure of sensitive data in logs. There are no reports of active exploitation or further impact such as code execution or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious about logging or displaying error messages from the net/textproto package that may contain untrusted input. Consider sanitizing or filtering error outputs before logging or displaying them.