VDB
CVE-2026-94440
CVE-2026-94440
PUBLISHED
CVSS 7.5 HIGH
Reported by Go · Published October 8, 2026
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | net/textproto | 0, 1.27.0-0 |
| Go standard library | mime/multipart | 0, 1.27.0-0 |
| chainguard | crossplane-provider-aws-serverlessrepo-fips | 0 |
| chainguard | kueue-0.18 | 0 |
| chainguard | kubernetes-csi-external-health-monitor-fips | 0 |
| chainguard | nuclio-controller-fips | 0 |
| chainguard | nri-kafka | * |
| chainguard | gendesk | 0 |
| chainguard | azuredisk-csi-fips-1.36 | 0 |
| chainguard | gitlab-cng-fips-19.4 | * |
| chainguard | kaniko-fips | 0 |
| chainguard | terraform-provider-sendgrid-fips | 0 |
| chainguard | trivy-fips | 0 |
| chainguard | harbor-2.13 | 0 |
| chainguard | kubernetes-fips-1.34 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0 |
| chainguard | chronograf | 0 |
| chainguard | prometheus-fips-3.13 | 0 |
| chainguard | go-1.25 | * |
| chainguard | prometheus-pushgateway-1.4 | 0 |
…and 2420 more
Timeline
- Oct 8, 2026 CVE Published
- Oct 9, 2026 EPSS Score
- Oct 9, 2026 Coalition ESS Score
- Oct 9, 2026 CVE Updated
- Oct 10, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 14, 2026 EPSS Score
- Oct 16, 2026 EPSS Score
- Oct 20, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 26, 2026 Distribution Patch