CVE-2026-94440: CWE-770: Allocation of Resources Without Limits or Throttling in Go standard library net/textproto

The vulnerability involves the allocation of resources without proper limits or throttling (CWE-770) in the Go standard library's net/textproto package. Specifically, when parsing multipart forms, the memory limit can be bypassed, enabling an attacker to cause the program to read an arbitrarily long line into memory if the remaining memory limit at the start of a multipart section is less than 400 bytes. This flaw affects versions of the Go standard library net/textproto package from 0 up to but not including 1.26.9, and from 1.27.0-0 up to but not including 1.27.2.

The impact is uncontrolled memory allocation which can lead to excessive memory consumption. This may cause denial of service conditions due to resource exhaustion. There is no indication of known exploits in the wild.

No patch links or vendor advisory details are provided, so patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting exposure to untrusted multipart form data or apply custom memory limits in their applications.