The flaw is in Go’s net/textproto package where error messages embed input values without escaping. An attacker who can influence those inputs can inject arbitrary content into error messages that may be displayed to users or written to logs. This raises the risk of misleading error output or the disclosure of sensitive information.

It affects the Go standard library component net/textproto. No specific version guidance is provided, so any Go version that includes the current implementation is potentially vulnerable until a fix is released.

EPSS score is < 1% and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; CVSS score is 5.3. The vulnerability is likely exploitable in any context where an application uses net/textproto to handle protocol data and forwards error messages to clients or logs them. The likely attack vector is remote, leveraged through the protocol handled by the application, and depends on whether the error content is exposed to users or captured in audit trails. Despite the moderate CVSS score of 5.3, the potential for log or output injection makes this a high‑impact concern for systems that rely on accurate error reporting.