CVE-2026-94440

A flaw was found in the mime/multipart and net/textproto packages in Go. A remote attacker could exploit this vulnerability by submitting a crafted multipart form request that bypasses configured memory limits when the remaining boundary limit is small. This issue allows the application to read an arbitrarily long line into memory, leading to excessive resource consumption and a Denial of Service (DoS).

This vulnerability is rated as having a Moderate severity for Red Hat products because, while an unauthenticated remote attacker can trigger excessive memory consumption leading to a denial of service, exploitation cannot lead to code execution or information disclosure. The issue specifically threatens Go-based services and daemons that accept and process incoming multipart HTTP form payloads. Applications built with Go that do not expose web interfaces or parse multipart request streams are unaffected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.