Is CVE-2026-94440 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94440 being exploited in the wild.

How severe is CVE-2026-94440?

High severity, with a CVSS score of 7.5, published 8 October 2026.

Which products and versions are affected?

go (Go) versions prior to the fix in Go 1.28; stdlib (Go) SEMVER:introduced=0,fixed=1.26.9,introduced=1.27.0-0,fixed=1.27.2.

Is there a fix for CVE-2026-94440?

Yes. stdlib (Go): upgrade to 1.27.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-94440 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-94440?

Check whether you run go (Go) or stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94440: Go memory limit bypass in MIME header parsing

CVE-2026-94440 · Severity: high · CVSS 7.5 · Published 2026-10-08

Go's net/textproto and mime/multipart libraries, used to parse email-style headers and multipart form data, can be bypassed to read arbitrarily long data into memory. An attacker sending a crafted multipart form request could exhaust server memory, causing denial of service on applications that rely on these limits for protection.

Technologies: go (Go), stdlib (Go). Vendors: Go.

Quick answers

Is CVE-2026-94440 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94440 being exploited in the wild.
How severe is CVE-2026-94440?: High severity, with a CVSS score of 7.5, published 8 October 2026.
Which products and versions are affected?: go (Go) versions prior to the fix in Go 1.28; stdlib (Go) SEMVER:introduced=0,fixed=1.26.9,introduced=1.27.0-0,fixed=1.27.2.
Is there a fix for CVE-2026-94440?: Yes. stdlib (Go): upgrade to 1.27.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94440 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-94440?: Check whether you run go (Go) or stdlib (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

stdlib (Go): upgrade to 1.27.2 or later
```
go get stdlib@v1.27.2
```

Technical details

When parsing multipart forms, the memory limit enforcement fails if the remaining byte limit at the start of a part is less than 400 bytes, allowing an attacker to bypass the limit and read an arbitrarily long line into memory. The vulnerability is in net/textproto and mime/multipart packages. A fix has been implemented and committed.

Affected products

Go Go versions prior to the fix in Go 1.28

Identifiers

CVE-2026-94440
GO-2026-6608

Timeline

2026-09-24: disclosed: Issue reported and privately tracked
2026-10-08: advisory: Public advisory published as GO-2026-6608

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.