Decoding a maliciously‑crafted MIME header that contains many invalid encoded‑words triggers a quadratic‑time algorithm in the Go standard library mime.WordDecoder.DecodeHeader function. This leads to excessive CPU consumption and can cause a denial of service when the application is under load. The issue is a resource exhaustion flaw (CWE‑442) caused by quadratic‑time complexity (CWE‑407).

The vulnerability affects the Go standard library mime package. All Go installations that include this package and have not applied the recent upstream fix are vulnerable; the advisory does not list specific Go releases, so any version prior to the patch is potentially impacted.

The CVSS score is 7.5 and the EPSS score is below 1%. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation. Attackers could trigger the DoS by sending large malformed MIME headers to any service that parses them, such as email servers or HTTP handlers that use the mime package. The flaw requires the attacker to deliver the crafted header to the target and does not provide code execution or other privileges.