Security: CVE-2026-42504 (GO-2026-5038) — mime DoS in Go 1.26.3

Open Beginner friendly
#3,577 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
82/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
go
Domain
security

Research direction

Start with go.mod and confirm the declared Go version is the affected 1.26.3 release. Update it to Go 1.26.4, then run the project's standard checks and verify that the reported CVE-2026-42504 and CVE-2026-42507 findings no longer apply.

Written by the indexing model from the issue text.

Description

Summary

jfrog-cli is built with Go 1.26.3, which is vulnerable to a denial-of-service in mime.WordDecoder.DecodeHeader (CVE-2026-42504 / GO-2026-5038).

Vulnerability Details

Field Value
CVE CVE-2026-42504
OSV GO-2026-5038
Severity High
Affected github.com/golang/go from go1.26.0 before go1.26.4
Fix go1.26.4 (released 2026-06-02)

Evidence — JFrog Xray scan

We noticed this while running Xray scans on CI agent images that bundle the jfrog-cli binary. A build scan of an image running jf version 2.111.0 (Go 1.26.3) surfaces:

CVE            | Severity | Component            | Version | Fixed in
CVE-2026-42504 | High     | github.com/golang/go | 1.26.3  | 1.26.4
CVE-2026-42507 | Medium   | github.com/golang/go | 1.26.3  | 1.26.4
CVE-2026-27145 | Medium   | github.com/golang/go | 1.26.3  | —

Go 1.26.4 resolves the first two. We noticed this while running JFrog Xray scans on CI agent images that bundle the jfrog-cli binary — it would be great to get this patched upstream so the fix flows through automatically.

Fix

One-line change in go.mod — a PR is attached:

-go 1.26.3
+go 1.26.4

References

Dominant language
Go
Stars
595
Forks
307
Avg merge
4d 17h
Merged PRs (30d)
17

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from jfrog/jfrog-cli

All issues in jfrog/jfrog-cli

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.