CVE-2026-42504

HighCVSS 7.5/10Last modified Jul 22, 2026

Description

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-407

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jun 2, 2026
Last modified
Jul 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-425055.3Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key idenCVE-2026-425066.1Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacCVE-2026-425075.3When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to CVE-2026-425089.1Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' CVE-2026-425096.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects ApaCVE-2026-42512.5A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of tCVE-2026-425107.2OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.CVE-2026-425118.1The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf dirCVE-2026-425128.1As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expanCVE-2026-425138.8This vulnerability exists in e-Sushrut due to improper authentication logic that relies on client-side response parameters to determine authCVE-2026-425148.8This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A remote attacker could exploit this vulneCVE-2026-425157.1This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit
CVE-2026-42504: High severity, CVSS 7.5 | Vulnix