Security: CVE-2026-42504 (GO-2026-5038) — mime DoS in Go 1.26.3

Summary

jfrog-cli is built with Go 1.26.3, which is vulnerable to a denial-of-service in mime.WordDecoder.DecodeHeader (CVE-2026-42504 / GO-2026-5038).

Vulnerability Details

Evidence — JFrog Xray scan

We noticed this while running Xray scans on CI agent images that bundle the jfrog-cli binary. A build scan of an image running jf version 2.111.0 (Go 1.26.3) surfaces:

CVE            | Severity | Component            | Version | Fixed in
CVE-2026-42504 | High     | github.com/golang/go | 1.26.3  | 1.26.4
CVE-2026-42507 | Medium   | github.com/golang/go | 1.26.3  | 1.26.4
CVE-2026-27145 | Medium   | github.com/golang/go | 1.26.3  | —

Go 1.26.4 resolves the first two. We noticed this while running JFrog Xray scans on CI agent images that bundle the jfrog-cli binary — it would be great to get this patched upstream so the fix flows through automatically.

Fix

One-line change in go.mod — a PR is attached:

-go 1.26.3
+go 1.26.4

References

• https://pkg.go.dev/vuln/GO-2026-5038
• https://go.dev/dl/#go1.26.4

Start with go.mod and confirm the declared Go version is the affected 1.26.3 release. Update it to Go 1.26.4, then run the project's standard checks and verify that the reported CVE-2026-42504 and CVE-2026-42507 findings no longer apply.