Threat database

CVE-2026-94440 is a high-severity vulnerability in the Go standard library net/textproto package. It involves allocation of resources without limits or throttling when parsing multipart forms. Specifically, the vulnerability allows bypassing memory limits and reading an arbitrarily long line into memory if the remaining limit at the start of a part is less than 400 bytes. This can lead to excessive memory consumption and potential denial of service.

CVE-2025-61724 is a medium severity vulnerability in the Go standard library's net/textproto package. The Reader.ReadResponse function uses repeated string concatenation to build response strings from multiple lines, causing inefficient algorithmic complexity. This inefficiency can lead to excessive CPU consumption and denial of service due to resource exhaustion. There is no impact on confidentiality or integrity. No patch or official fix has been confirmed yet.