CVE-2026-39820

HIGH

Quadratic string concatentation in consumeComment in net/mail

Title source: cna
STIX 2.1

Description

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

References (17)

Core 17
Core References

Scores

CVSS v3 7.5
EPSS 0.0078
EPSS Percentile 51.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-606 CWE-770
Status published
Products (3)
Go standard library/net/mail < 1.25.10
Go standard library/net/mail 1.26.0-0 - 1.26.3
golang/go < 1.25.10
Published May 07, 2026
Tracked Since May 08, 2026