The flaw is in Go’s net/textproto package where error messages embed input values without escaping. An attacker who can influence those inputs can inject arbitrary content into error messages that may be displayed to users or written to logs. This raises the risk of misleading error output or the disclosure of sensitive information.

It affects the Go standard library component net/textproto. No specific version guidance is provided, so any Go version that includes the current implementation is potentially vulnerable until a fix is released.

EPSS score is not available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; CVSS metrics are not provided. The vulnerability is likely exploitable in any context where an application uses net/textproto to handle protocol data and forwards error messages to clients or logs them. The attack vector would be remote, leveraged through the protocol handled by the application, and depends on whether the error content is exposed to users or captured in audit trails. Despite the lack of official severity metrics, the potential for log or output injection makes this a high‑impact concern for systems that rely on accurate error reporting.