CVE-2026-42499

HIGH

Quadratic string concatenation in consumePhrase in net/mail

Title source: cna
STIX 2.1

Description

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

References (17)

Core 17
Core References

Scores

CVSS v3 7.5
EPSS 0.0080
EPSS Percentile 52.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-1046
Status published
Products (3)
Go standard library/net/mail < 1.25.10
Go standard library/net/mail 1.26.0-0 - 1.26.3
golang/go < 1.25.10
Published May 07, 2026
Tracked Since May 08, 2026