Improper Neutralization of Attacker-Controlled Input in Go net/textproto Error Messages

CVE-2026-42507 affects the Go standard library net/textproto package. When returning errors, affected functions included attacker-controlled input directly in the error text without escaping or neutralization. In normal usage, this input may originate from external parties, such as data parsed from remote servers; for example, net/http clients use ReadMIMEHeader when parsing headers received from a server. Because the raw input was embedded in returned errors, a malicious peer could cause arbitrary content to appear in application error output or logs. The issue is specifically an error-handling flaw in which untrusted input is reflected into error messages without sanitization.