Security: CVE-2026-42504 - HIGH

[abeytom07]

Please upgrade Go version to 1.26.4 to fix HIGH Severity CVE-2026-42504

[databus23]

Thanks for the report!

I looked into this. CVE-2026-42504 affects mime.WordDecoder.DecodeHeader, which is used for decoding RFC 2047 encoded-words in email-style MIME headers. helm-diff doesn't use this function anywhere. The mime package only appears in our dependency tree transitively via net/http for Content-Type parsing, which is an entirely unrelated code path.

There's no attack surface here since helm-diff is a CLI tool that talks to the Kubernetes API and the local helm binary, it never processes email-style MIME headers.

That said, we'll bump to Go 1.26.4 with the next release to pick up the backported fix. We just don't see an imminent threat from the current version.